Skip to content

Commit e6507cf

Browse files
ambuj-1211ambuj-1211
authored
Merge branch 'CycloneDX:master' into Refactor-poetry-install-command
2 parents 17aff60 + 08a0d2b commit e6507cf

File tree

161 files changed

+10072
-2601
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

161 files changed

+10072
-2601
lines changed

‎.github/actions/build-docker-image/action.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Build a Docker image
2+
description: |
3+
This action does the actual building of an image, based on the given
4+
parameters. Depending on the configured 'action', the image is then pushed
5+
to a registry or loaded into the local Docker.
6+
7+
inputs:
8+
action:
9+
description: Action to run on completion of the build -- either 'load' or 'push''
10+
required: true
11+
dockerfile:
12+
description: Dockerfile that describes the image
13+
required: true
14+
labels:
15+
description: Labels to add to the image
16+
platforms:
17+
description: The platforms for which to build the image
18+
required: true
19+
tags:
20+
description: All tags for the image
21+
required: true
22+
target:
23+
description: Which stage in the Dockerfile to build
24+
required: true
25+
26+
runs:
27+
using: composite
28+
steps:
29+
- name: Build Docker image
30+
uses: docker/build-push-action@v6
31+
with:
32+
context: .
33+
file: ${{ inputs.dockerfile }}
34+
labels: ${{ inputs.labels }}
35+
load: ${{ inputs.action == 'load' }}
36+
platforms: ${{ inputs.platforms }}
37+
push: ${{ inputs.action == 'push' }}
38+
tags: ${{ inputs.tags }}
39+
target: ${{ inputs.target }}

‎.github/actions/build-docker-images-generate-attach-sboms/action.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Build Docker image, generate & attach SBOM
2+
description: |
3+
Build and push a multi-platform (always AMD64, configurably ARM64) Docker
4+
image and generate and attach an SBOM for all configured platforms.
5+
6+
inputs:
7+
build-arm:
8+
description: Whether or not to build the arm image
9+
required: true
10+
dockerfile:
11+
description: Dockerfile that describes the image
12+
required: true
13+
images:
14+
description: The name(s) of the image(s) to load metadata for
15+
required: true
16+
main-tag:
17+
description: The tag to attach the SBOMs to, defaults to the first tag returned from the metadata extraction
18+
signing-key:
19+
description: The key to use for signing the SBOM, base64 encoded
20+
required: true
21+
tags:
22+
description: All tags to set for this image, defaults to all tags returned from the metadata extraction
23+
target:
24+
description: Which stage in the Dockerfile to build
25+
required: true
26+
27+
runs:
28+
using: composite
29+
steps:
30+
- name: Extract metadata (tags, labels) for Docker image
31+
id: metadata
32+
uses: docker/metadata-action@v5
33+
with:
34+
images: ${{ inputs.images }}
35+
- name: Build and push image
36+
uses: ./.github/actions/build-docker-image
37+
with:
38+
action: push
39+
dockerfile: ${{ inputs.dockerfile }}
40+
labels: ${{ steps.metadata.outputs.labels }}
41+
platforms: linux/amd64${{ inputs.build-arm == 'true' && ',linux/arm64' || '' }}
42+
tags: ${{ inputs.tags || steps.metadata.outputs.tags }}
43+
target: ${{ inputs.target }}
44+
- name: Generate and attach SBOM for amd64
45+
uses: ./.github/actions/generate-attach-sbom
46+
with:
47+
dockerfile: ${{ inputs.dockerfile }}
48+
platform: linux/amd64
49+
signing-key: ${{ inputs.signing-key }}
50+
tag: ${{ inputs.main-tag || fromJSON(steps.metadata.outputs.json).tags[0] }}
51+
target: ${{ inputs.target }}
52+
- name: Generate and attach SBOM for arm64
53+
if: ${{ inputs.build-arm == 'true' }}
54+
uses: ./.github/actions/generate-attach-sbom
55+
with:
56+
dockerfile: ${{ inputs.dockerfile }}
57+
platform: linux/arm64
58+
signing-key: ${{ inputs.signing-key }}
59+
tag: ${{ inputs.main-tag || fromJSON(steps.metadata.outputs.json).tags[0] }}
60+
target: ${{ inputs.target }}

‎.github/actions/generate-attach-sbom/action.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Generate and attach SBOM
2+
description: |
3+
Generate and attach an SBOM to the configured platform-version of an image
4+
in its registry.
5+
6+
inputs:
7+
dockerfile:
8+
description: Dockerfile that describes the image
9+
required: true
10+
platform:
11+
description: The platforms for which to build the image
12+
required: true
13+
tag:
14+
description: All tags for the image
15+
required: true
16+
signing-key:
17+
description: The key to use for signing the SBOM, base64 encoded
18+
required: true
19+
target:
20+
description: Which stage in the Dockerfile to build
21+
required: true
22+
23+
runs:
24+
using: composite
25+
steps:
26+
- name: Build and load image
27+
uses: ./.github/actions/build-docker-image
28+
with:
29+
action: load
30+
dockerfile: ${{ inputs.dockerfile }}
31+
platforms: ${{ inputs.platform }}
32+
tags: ${{ inputs.tag }}
33+
target: ${{ inputs.target }}
34+
- name: Generate and attach SBOM
35+
shell: bash
36+
run: |
37+
node bin/cdxgen.js -t docker -o sbom-oci-image.cdx.json ${{ inputs.tag }}
38+
node bin/verify.js -i sbom-oci-image.cdx.json --public-key contrib/bom-signer/public.key
39+
oras attach --artifact-type sbom/cyclonedx --platform ${{ inputs.platform }} ${{ inputs.tag }} ./sbom-oci-image.cdx.json:application/json
40+
oras discover --format tree --platform ${{ inputs.platform }} ${{ inputs.tag }}
41+
node bin/verify.js -i ${{ inputs.tag }} --platform ${{ inputs.platform }} --public-key contrib/bom-signer/public.key
42+
docker rmi ${{ inputs.tag }}
43+
rm sbom-oci-image.cdx.json
44+
env:
45+
CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-sboms
46+
DOCKER_USE_CLI: true
47+
SBOM_SIGN_ALGORITHM: RS512
48+
SBOM_SIGN_PRIVATE_KEY_BASE64: ${{ inputs.signing-key }}

‎.github/codeql/config.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
analysis:
3+
javascript-typescript:
4+
validationFunctions:
5+
- name: isAllowedHost
6+
- name: isAllowedPath

‎.github/workflows/binary-builds.yml‎

Lines changed: 117 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -18,77 +18,170 @@ concurrency:
1818
cancel-in-progress: true
1919

2020
jobs:
21+
musl-builds:
22+
if: github.repository == 'CycloneDX/cdxgen'
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
os: [ 'ubuntu-22.04' ]
27+
include:
28+
- os: ubuntu-22.04
29+
build: |
30+
rm -rf ci contrib tools_config
31+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdxgen" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
32+
chmod +x cdxgen
33+
./cdxgen --help
34+
sha256sum cdxgen > cdxgen.sha256
35+
rm -rf node_modules
36+
pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --no-optional --prod --package-import-method copy --frozen-lockfile
37+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdxgen-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
38+
chmod +x cdxgen-slim
39+
./cdxgen-slim --version
40+
sha256sum cdxgen-slim > cdxgen-slim.sha256
41+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdx-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
42+
chmod +x cdx-verify
43+
./cdx-verify --version
44+
sha256sum cdx-verify > cdx-verify.sha256
45+
./cdxgen --help
46+
./cdxgen-slim --help
47+
./cdx-verify --help
48+
mv cdxgen cdxgen-musl
49+
mv cdxgen.sha256 cdxgen-musl.sha256
50+
mv cdxgen-slim cdxgen-musl-slim
51+
mv cdxgen-slim.sha256 cdxgen-musl-slim.sha256
52+
mv cdx-verify cdx-musl-verify
53+
mv cdx-verify.sha256 cdx-musl-verify.sha256
54+
artifact: cdxgen-musl
55+
sartifact: cdxgen-musl-slim
56+
vartifact: cdx-musl-verify
57+
runs-on: ${{ matrix.os }}
58+
container:
59+
image: alpine:3.20
60+
permissions:
61+
contents: write
62+
packages: write
63+
steps:
64+
- uses: actions/checkout@v4
65+
- name: Setup alpine builder
66+
run: |
67+
apk add --no-cache nodejs make python3 python3-dev py3-pip py3-virtualenv gcc g++ musl-dev npm
68+
- name: Install pnpm
69+
run: |
70+
npm install --global [email protected]
71+
pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --prod --package-import-method copy --frozen-lockfile
72+
- name: Produce sae
73+
run: |
74+
${{ matrix.build }}
75+
env:
76+
CDXGEN_DEBUG_MODE: debug
77+
- name: Release
78+
uses: softprops/action-gh-release@v2
79+
if: startsWith(github.ref, 'refs/tags/')
80+
with:
81+
files: |
82+
${{ matrix.artifact }}
83+
${{ matrix.artifact }}.sha256
84+
${{ matrix.sartifact }}
85+
${{ matrix.sartifact }}.sha256
86+
${{ matrix.vartifact }}
87+
${{ matrix.vartifact }}.sha256
2188
sae-builds:
2289
if: github.repository == 'CycloneDX/cdxgen'
2390
strategy:
91+
fail-fast: false
2492
matrix:
25-
os: ['ubuntu-22.04', 'windows-latest', 'ubuntu-22.04-arm']
93+
os: ['ubuntu-22.04', 'windows-2022', 'windows-11-arm', 'ubuntu-22.04-arm']
2694
include:
2795
- os: ubuntu-22.04
2896
build: |
2997
rm -rf ci contrib tools_config
30-
npx --yes @appthreat/caxa --input . --output "cdxgen" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
98+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdxgen" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
3199
chmod +x cdxgen
32100
./cdxgen --help
33101
sha256sum cdxgen > cdxgen.sha256
34102
rm -rf node_modules
35-
corepack pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --no-optional --prod --package-import-method copy --frozen-lockfile
36-
npx --yes @appthreat/caxa --input . --output "cdxgen-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
103+
pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --no-optional --prod --package-import-method copy --frozen-lockfile
104+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdxgen-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
37105
chmod +x cdxgen-slim
38106
./cdxgen-slim --version
39107
sha256sum cdxgen-slim > cdxgen-slim.sha256
40-
npx --yes @appthreat/caxa --input . --output "cdx-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
108+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdx-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
41109
chmod +x cdx-verify
42110
./cdx-verify --version
43111
sha256sum cdx-verify > cdx-verify.sha256
44-
CDXGEN_DEBUG_MODE=debug ./cdxgen --help
112+
./cdxgen --help
45113
./cdxgen-slim --help
114+
./cdx-verify --help
46115
artifact: cdxgen
47116
sartifact: cdxgen-slim
48117
vartifact: cdx-verify
49118
- os: ubuntu-22.04-arm
50119
build: |
51120
rm -rf ci contrib tools_config
52-
npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-arm64" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
121+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdxgen-arm64" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
53122
chmod +x cdxgen-arm64
54123
./cdxgen-arm64 --version
55124
sha256sum cdxgen-arm64 > cdxgen-arm64.sha256
56125
rm -rf node_modules
57-
corepack pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --no-optional --prod --package-import-method copy --frozen-lockfile
58-
npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-arm64-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
126+
pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --no-optional --prod --package-import-method copy --frozen-lockfile
127+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdxgen-arm64-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
59128
chmod +x cdxgen-arm64-slim
60129
./cdxgen-arm64-slim --version
61130
sha256sum cdxgen-arm64-slim > cdxgen-arm64-slim.sha256
62-
npx --no-progress --yes @appthreat/caxa --input . --output "cdx-arm64-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
131+
pnpm --package=@appthreat/caxa dlx caxa --input . --output "cdx-arm64-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
63132
chmod +x cdx-arm64-verify
64133
./cdx-arm64-verify --version
65134
sha256sum cdx-arm64-verify > cdx-arm64-verify.sha256
66-
CDXGEN_DEBUG_MODE=debug ./cdxgen-arm64 --help
135+
./cdxgen-arm64 --help
67136
./cdxgen-arm64-slim --help
137+
./cdx-arm64-verify --help
68138
artifact: cdxgen-arm64
69139
sartifact: cdxgen-arm64-slim
70140
vartifact: cdx-arm64-verify
71-
- os: windows-latest
141+
- os: windows-2022
72142
build: |
73143
Remove-Item ci -Recurse -Force
74144
Remove-Item contrib -Recurse -Force
75145
Remove-Item tools_config -Recurse -Force
76-
npx @appthreat/caxa --input . --output "cdxgen.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
146+
npm install --omit=dev --no-package-lock --no-audit --no-fund --no-progress
147+
npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
77148
.\cdxgen.exe --version
78149
(Get-FileHash .\cdxgen.exe).hash | Out-File -FilePath .\cdxgen.exe.sha256
79150
Remove-Item node_modules -Recurse -Force
80-
corepack pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --no-optional --prod --package-import-method copy --frozen-lockfile
81-
npx @appthreat/caxa --input . --output "cdxgen-slim.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
151+
npm install --omit=optional --omit=dev --no-package-lock --no-audit --no-fund
152+
npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-slim.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
82153
.\cdxgen-slim.exe --version
83154
(Get-FileHash .\cdxgen-slim.exe).hash | Out-File -FilePath .\cdxgen-slim.exe.sha256
84-
npx @appthreat/caxa --input . --output "cdx-verify.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
85-
.\cdx-verify.exe --version
155+
npx --no-progress --yes @appthreat/caxa --input . --output "cdx-verify.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
86156
(Get-FileHash .\cdx-verify.exe).hash | Out-File -FilePath .\cdx-verify.exe.sha256
87157
.\cdxgen.exe --help
88158
.\cdxgen-slim.exe --help
159+
.\cdx-verify.exe --help
89160
artifact: cdxgen.exe
90161
sartifact: cdxgen-slim.exe
91162
vartifact: cdx-verify.exe
163+
- os: windows-11-arm
164+
build: |
165+
Remove-Item ci -Recurse -Force
166+
Remove-Item contrib -Recurse -Force
167+
Remove-Item tools_config -Recurse -Force
168+
npm install --omit=dev --no-package-lock --no-audit --no-fund --no-progress
169+
npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-arm.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
170+
.\cdxgen-arm.exe --version
171+
(Get-FileHash .\cdxgen-arm.exe).hash | Out-File -FilePath .\cdxgen-arm.exe.sha256
172+
Remove-Item node_modules -Recurse -Force
173+
npm install --omit=optional --omit=dev --no-package-lock --no-audit --no-fund
174+
npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-arm-slim.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
175+
.\cdxgen-arm-slim.exe --version
176+
(Get-FileHash .\cdxgen-arm-slim.exe).hash | Out-File -FilePath .\cdxgen-arm-slim.exe.sha256
177+
npx --no-progress --yes @appthreat/caxa --input . --output "cdx-arm-verify.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
178+
(Get-FileHash .\cdx-arm-verify.exe).hash | Out-File -FilePath .\cdx-arm-verify.exe.sha256
179+
.\cdxgen-arm.exe --help
180+
.\cdxgen-arm-slim.exe --help
181+
.\cdx-arm-verify.exe --help
182+
artifact: cdxgen-arm.exe
183+
sartifact: cdxgen-arm-slim.exe
184+
vartifact: cdx-arm-verify.exe
92185
runs-on: ${{ matrix.os }}
93186
permissions:
94187
contents: write
@@ -99,12 +192,16 @@ jobs:
99192
uses: actions/setup-node@v4
100193
with:
101194
node-version: '24.x'
195+
- name: Install pnpm
196+
run: |
197+
npm install --global [email protected]
198+
pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --prod --package-import-method copy --frozen-lockfile
199+
if: ${{ !startsWith(matrix.os, 'windows') }}
102200
- name: Produce sae
103201
run: |
104-
npm install --global corepack@latest
105-
corepack enable pnpm
106-
corepack pnpm install --config.strict-dep-builds=true --virtual-store-dir node_modules/pnpm --prod --package-import-method copy --frozen-lockfile
107202
${{ matrix.build }}
203+
env:
204+
CDXGEN_DEBUG_MODE: debug
108205
- uses: actions/upload-artifact@v4
109206
with:
110207
name: ${{ matrix.artifact }}

0 commit comments

Comments
 (0)