also looking at this
fix(release): attach and verify generated SBOM assets
#294
5 files
+108
-18
| @@ -22,6 +22,10 @@ jobs: | ||
| 22 | 22 | - name: Validate tag and workspace versions |
| 23 | 23 | run: bun scripts/release-version.ts |
| 24 | 24 | |
| 25 | release-sbom: | |
| 26 | needs: validate-release | |
| 27 | uses: ./.github/workflows/sbom.yml | |
| 28 | ||
| 25 | 29 | pantry: |
| 26 | 30 | needs: [validate-release] |
| 27 | 31 | name: pantry (${{ matrix.platform.name }}) |
| @@ -433,8 +437,8 @@ jobs: | ||
| 433 | 437 | |
| 434 | 438 | verify-macos-downloads: |
| 435 | 439 | name: verify downloaded ${{ matrix.platform.name }} |
| 436 | needs: [pantry] | |
| 437 | if: ${{ !cancelled() }} | |
| 440 | needs: [validate-release, pantry] | |
| 441 | if: ${{ !cancelled() && needs.validate-release.result == 'success' }} | |
| 438 | 442 | strategy: |
| 439 | 443 | fail-fast: false |
| 440 | 444 | matrix: |
| @@ -460,6 +464,36 @@ jobs: | ||
| 460 | 464 | ditto -x -k "$DOWNLOAD_DIR/craft-$PLATFORM.zip" "$DOWNLOAD_DIR/extracted" |
| 461 | 465 | bun scripts/verify-macos-release.ts "$DOWNLOAD_DIR/extracted/craft" "${TAG#v}" |
| 462 | 466 | |
| 467 | attach-release-sbom: | |
| 468 | name: attach and verify release SBOMs | |
| 469 | needs: [pantry, release-sbom] | |
| 470 | runs-on: ubuntu-latest | |
| 471 | permissions: | |
| 472 | contents: write | |
| 473 | steps: | |
| 474 | - uses: actions/checkout@v6 | |
| 475 | - uses: oven-sh/setup-bun@v2 | |
| 476 | - uses: actions/download-artifact@v4 | |
| 477 | with: | |
| 478 | name: sbom | |
| 479 | path: sbom | |
| 480 | - name: Attach the SBOMs produced by this release run | |
| 481 | env: | |
| 482 | GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| 483 | TAG: ${{ github.ref_name }} | |
| 484 | run: | | |
| 485 | set -euo pipefail | |
| 486 | bun scripts/verify-sbom.ts sbom "$TAG" | |
| 487 | gh release upload "$TAG" --repo "$GITHUB_REPOSITORY" \ | |
| 488 | sbom/craft-sbom.json sbom/full-sbom.cyclonedx.json sbom/full-sbom.spdx.json --clobber | |
| 489 | VERIFY_DIR=$(mktemp -d) | |
| 490 | gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern 'craft-sbom.json' \ | |
| 491 | --pattern 'full-sbom.cyclonedx.json' --pattern 'full-sbom.spdx.json' --dir "$VERIFY_DIR" | |
| 492 | bun scripts/verify-sbom.ts "$VERIFY_DIR" "$TAG" | |
| 493 | for document in craft-sbom.json full-sbom.cyclonedx.json full-sbom.spdx.json; do | |
| 494 | cmp "sbom/$document" "$VERIFY_DIR/$document" | |
| 495 | done | |
| 496 | ||
| 463 | 497 | npm: |
| 464 | 498 | name: npm |
| 465 | 499 | # Ordered after the binaries, not gated on them. |