Skip to content

Commit 664c54b

Browse files
jalsethjalseth
committed
test sbom
1 parent b6a7a3c commit 664c54b

File tree

2 files changed

+92
-71
lines changed

2 files changed

+92
-71
lines changed

‎.github/workflows/integrate.yaml‎

Lines changed: 84 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -8,80 +8,94 @@ on:
88
- 'master'
99

1010
jobs:
11-
# goreleaser:
12-
# runs-on: 'ubuntu-latest'
13-
# permissions:
14-
# contents: 'write' # Needs write access for upload-artifact.
15-
# outputs:
16-
# hashes: '${{ steps.outputs.outputs.hashes }}'
17-
# steps:
18-
# - name: 'checkout'
19-
# uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
20-
# with:
21-
# fetch-depth: 0 # So that goreleaser can determine the base version.
22-
# - name: 'build'
23-
# id: 'goreleaser'
24-
# uses: 'goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a' # ratchet:goreleaser/goreleaser-action@v6
25-
# with:
26-
# args: 'release --snapshot --clean --skip docker --skip publish'
27-
# version: '~> v1'
28-
# - name: 'get version'
29-
# id: 'version'
30-
# shell: 'bash'
31-
# run: |
32-
# echo "version=$(jq -r .version dist/metadata.json)" >> "$GITHUB_OUTPUT"
33-
# - name: 'upload'
34-
# uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
35-
# with:
36-
# name: 'conftest_${{ steps.version.outputs.version }}'
37-
# path: 'dist/*.*'
38-
# retention-days: 30
39-
# - name: 'generate outputs'
40-
# id: 'outputs'
41-
# env:
42-
# GORELEASER_ARTIFACTS: '${{ steps.goreleaser.outputs.artifacts }}'
43-
# shell: 'bash'
44-
# run: |
45-
# set -euo pipefail
46-
47-
# checksum_file=$(echo "${GORELEASER_ARTIFACTS}" | jq -r '.[] | select (.type == "Checksum") | .path' | tr -d '\n')
48-
# echo "hashes=$(cat ${checksum_file} | base64 -w0)" >> "$GITHUB_OUTPUT"
49-
50-
# binary-provenance:
51-
# needs: ['goreleaser']
52-
# permissions:
53-
# contents: 'write' # Needs write access for upload-artifact even when upload-assets is false.
54-
# actions: 'read' # To read the workflow path.
55-
# id-token: 'write' # To sign the provenance.
56-
# uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 # ratchet:exclude
57-
# with:
58-
# base64-subjects: '${{ needs.goreleaser.outputs.hashes }}'
59-
# upload-assets: false
60-
61-
docker:
11+
goreleaser:
6212
runs-on: 'ubuntu-latest'
6313
permissions:
64-
contents: 'read'
14+
contents: 'write' # Needs write access for upload-artifact.
6515
outputs:
66-
digest: '${{ steps.build.outputs.digest }}'
16+
checksums-handle: '${{ steps.checksum-handle.outputs.handle }}'
6717
env:
68-
CONFTEST_IMAGE: 'openpolicyagent/conftest'
69-
strategy:
70-
matrix:
71-
target:
72-
- '' # Conftest
73-
# - 'examples' # Examples
74-
platform:
75-
- 'linux/amd64'
76-
# - 'linux/arm64'
18+
CGO_ENABLED: '0'
19+
CHECKSUMS_FILE_NAME: 'checksums.txt'
7720
steps:
78-
- name: 'setup docker buildx'
79-
run: 'docker buildx create --name conftestbuild --use'
21+
- name: 'checkout'
22+
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
23+
with:
24+
fetch-depth: 0 # So that goreleaser can determine the base version.
25+
- name: setup go
26+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # ratchet:actions/setup-go@v6
27+
with:
28+
go-version: "1.25.x"
29+
- name: 'setup cyclonedx-gomod'
30+
uses: 'CycloneDX/gh-gomod-generate-sbom@efc74245d6802c8cefd925620515442756c70d8f' # ratchet:CycloneDX/gh-gomod-generate-sbom@v2
31+
with:
32+
version: 'v1'
8033
- name: 'build'
81-
id: 'build'
82-
uses: 'docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83' # ratchet:docker/build-push-action@v6
34+
id: 'goreleaser'
35+
uses: 'goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a' # ratchet:goreleaser/goreleaser-action@v6
36+
with:
37+
version: '~> v1'
38+
args: >-
39+
release
40+
--snapshot
41+
--clean
42+
--skip docker
43+
--skip publish
44+
- name: 'get version'
45+
id: 'version'
46+
shell: 'bash'
47+
run: |
48+
echo "version=$(jq -r .version dist/metadata.json)" >> "$GITHUB_OUTPUT"
49+
- name: 'upload build'
50+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
51+
with:
52+
name: 'conftest_${{ steps.version.outputs.version }}'
53+
path: 'dist/*.*'
54+
retention-days: 30
55+
- name: 'base64 checksum for provenance input'
56+
shell: 'bash'
57+
run: 'base64 -w0 "dist/${CHECKSUMS_FILE_NAME}" > "${CHECKSUMS_FILE_NAME}"'
58+
- name: 'get checksums handle'
59+
id: 'checksum-handle'
60+
uses: 'slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@v2.1.0' # ratchet:exclude
8361
with:
84-
push: false
85-
# target: '${{ matrix.target }}'
86-
tags: '${{ env.CONFTEST_IMAGE }}:latest'
87-
# platforms: '${{ matrix.platform }}'
62+
path: '${{ env.CHECKSUMS_FILE_NAME }}'
63+
64+
binary-provenance:
65+
needs: ['goreleaser']
66+
permissions:
67+
contents: 'write' # Needs write access for upload-artifact even when upload-assets is false.
68+
actions: 'read' # To read the workflow path.
69+
id-token: 'write' # To sign the provenance.
70+
uses: 'slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0' # ratchet:exclude
71+
with:
72+
base64-subjects-as-file: '${{ needs.goreleaser.outputs.checksums-handle }}'
73+
upload-assets: false
74+
75+
# docker:
76+
# runs-on: 'ubuntu-latest'
77+
# permissions:
78+
# contents: 'read'
79+
# outputs:
80+
# digest: '${{ steps.build.outputs.digest }}'
81+
# env:
82+
# CONFTEST_IMAGE: 'openpolicyagent/conftest'
83+
# strategy:
84+
# matrix:
85+
# target:
86+
# - '' # Conftest
87+
# # - 'examples' # Examples
88+
# platform:
89+
# - 'linux/amd64'
90+
# # - 'linux/arm64'
91+
# steps:
92+
# - name: 'setup docker buildx'
93+
# run: 'docker buildx create --name conftestbuild --use'
94+
# - name: 'build'
95+
# id: 'build'
96+
# uses: 'docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83' # ratchet:docker/build-push-action@v6
97+
# with:
98+
# push: false
99+
# # target: '${{ matrix.target }}'
100+
# tags: '${{ env.CONFTEST_IMAGE }}:latest'
101+
# # platforms: '${{ matrix.platform }}'

‎.goreleaser.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,13 @@ version: 1
22

33
before:
44
hooks:
5-
- go mod download
5+
- 'go mod download'
6+
- >-
7+
cyclonedx-gomod app
8+
-main .
9+
-licenses
10+
-json
11+
-output cyclonedx_bom.json
612
713
builds:
814
- main: ./main.go
@@ -40,6 +46,7 @@ archives:
4046
files:
4147
- LICENSE
4248
- README.md
49+
- cyclonedx_bom.json
4350
- plugin/*.sh
4451

4552
checksum:

0 commit comments

Comments
 (0)