Add SBOM generation and Dependency Track upload #50
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
12 times, most recently
from
0fb3443 to
8869777
Compare
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
printminion-co
force-pushed
the
ionos-dev
branch
from
d4fe101 to
83c6dc5
Compare
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
from
6cc653b to
9c79207
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
.github/workflows/sbom.yaml
Outdated
| - name: Generate SBOM (composer) | ||
| # Output filename can not be configured, is bom.xml | ||
| # https://github.com/CycloneDX/gh-php-composer-generate-sbom | ||
| uses: CycloneDX/gh-php-composer-generate-sbom@v1 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow
Comment on lines
72
to
121
| needs: generate-sbom | ||
| runs-on: ubuntu-latest | ||
|
|
||
| # https://docs.github.com/en/actions/writing-workflows/choosing-where-your-workflow-runs/running-jobs-in-a-container | ||
| container: | ||
| image: cyclonedx/cyclonedx-cli:0.27.1 | ||
|
|
||
| steps: | ||
| - name: Download partial BOMs | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: bom-partials | ||
|
|
||
| - name: Merge SBOMs | ||
| # https://github.com/CycloneDX/cyclonedx-cli#merge-command | ||
| # Using v1_3 because with the default (1.6) the upload failed at the DT web interface | ||
| # | ||
| # The generated SBOM is fixed with sed to remove potentially bad characters | ||
| # Slashes are not allowed after the @ in the meta/component's bom-ref | ||
| # attribute and purl node. | ||
| run: | | ||
| cyclonedx merge --input-files bom.composer.xml bom.npm.xml --output-file bom.xml --output-version v1_3 | ||
| sed -i -r 's;(pkg:composer/__root__)@[^"<]+;\1@merged-sbom;' bom.xml | ||
|
|
||
| # Pass merged BOM to next Job | ||
| # https://github.com/actions/upload-artifact | ||
| - name: Store merged BOM | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: final-bom | ||
| path: bom.xml | ||
|
|
||
| upload-sboms: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
.github/workflows/sbom.yaml
Outdated
Comment on lines
105
to
150
| needs: merge-sboms | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Download partial BOMs | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: final-bom | ||
|
|
||
| - name: Dump merged SBOM | ||
| run: | | ||
| cat bom.xml | ||
|
|
||
| # TODO: upload BOMs |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
from
110bbd4 to
e973a45
Compare
printminion-co
force-pushed
the
tl/sbom-generation
branch
from
e0ceff1 to
801e560
Compare
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
from
801e560 to
7ed8fa8
Compare
Upload to DT failed with schema validation error and no details, maybe the version is to recent.
Problem figured out: the merged SBOM contains a "component" node with a "bom-ref" attribute and a "purl" node, both contain values including the current Git branch name, which happens to contain a slash in my case, which, apparently, is not allowed. This reverts commit 2e39012.
Upload to DT failed with schema validation error and no details, maybe the version is to recent.
The action was declared to be deprecated [1], [2] was mentioned as alternative. [1]: https://github.com/CycloneDX/gh-node-module-generatebom?tab=readme-ov-file [2]: https://www.npmjs.com/package/%40cyclonedx/cyclonedx-npm
sh does not know about function keyword.
Signed-off-by: Misha M.-Kupriyanov <kupriyanov@strato.de>
Signed-off-by: Misha M.-Kupriyanov <kupriyanov@strato.de>
Signed-off-by: Misha M.-Kupriyanov <kupriyanov@strato.de>
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
from
7ed8fa8 to
b4ae197
Compare
Use the same step as the build workflow uses. The image does not come with PHP 8.3 anyway.
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
from
4496e41 to
d82f0f1
Compare
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
4 times, most recently
from
6877336 to
70219cc
Compare
thlehmann-ionos
force-pushed
the
tl/sbom-generation
branch
from
70219cc to
e072cda
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.