Split syft in more steps

Signed-off-by: Loïc Minier <[email protected]>

Author: lool

.github/workflows/debos.yml

@@ -148,20 +148,17 @@ jobs:
         - /srv/gh-runners/quic-yocto/builds:/fileserver-builds
         - /srv/gh-runners/quic-yocto/downloads:/fileserver-downloads
     steps:
-      - name: Get rootfs, generate SBOM with syft and upload to fileserver
+      - name: Retrieve rootfs from fileserver
+        run: cp -av /fileserver-downloads/${BUILD_ID}/rootfs.tar.gz .
+
+      - name: Unpack rootfs
+        run: mkdir -v rootfs && tar -C rootfs -xvf rootfs.tar.gz
+
+      - name: Generate SBOMs with Syft
         run: |
           set -ux
-          # curl will be used to talk to fileserver; should be installed by
-          # default
-          apt -y install curl
-          # retrieve and unpack rootfs
-          cp -av /fileserver-downloads/${BUILD_ID}/rootfs.tar.gz .
-          mkdir rootfs
-          tar -C rootfs -xvf rootfs.tar.gz
-          # run syft
           # TODO should probably restrict catalogers a bit as the rootfs is
           # built entirely from deb packages
-          # TODO should set source-version
           syft --version
           SYFT_FORMAT_JSON_PRETTY=true syft -v \
               -o cyclonedx-json=rootfs-sbom.cyclonedx.json \
@@ -174,14 +171,16 @@ jobs:
               --source-version "${BUILD_ID}" \
               -v \
               scan rootfs
-          # compress
+          # compress SBOMs
           gzip rootfs-sbom*
-          # copy to fileserver
-          for dir in
-              "/fileserver-builds/${BUILD_ID}"
-              "/fileserver-downloads/${BUILD_ID}"; do
-              cp -av rootfs-sbom*.gz "${dir}"
-          done
+
+      - name: Upload SBOMs to fileserver space for builds
+        run: |
+          # curl will be used to talk to fileserver; should be installed by
+          # default
+          apt -y install curl
+          # copy SBOMs to fileserver space for builds
+          cp -av rootfs-sbom*.gz "/fileserver-builds/${BUILD_ID}"
           # instruct fileserver to publish this directory
           url="${FILESERVER_URL}/${BUILD_ID}/"
           curl -X POST -H 'Accept: text/event-stream' "${url}"