forked from ko-build/ko
-
Notifications
You must be signed in to change notification settings - Fork 0
130 lines (104 loc) · 3.34 KB
/
sbom.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: Validate SBOMs
on:
pull_request:
branches: ['main']
jobs:
go-version-m:
name: Generate go version -m
runs-on: ubuntu-latest
env:
KO_DOCKER_REPO: localhost:1338
steps:
- uses: actions/setup-go@v3
with:
go-version: 1.17
check-latest: true
- uses: chainguard-dev/actions/setup-registry@main
- uses: actions/checkout@v3
- name: Generate
run: |
img=$(go run ./ build ./)
go run ./ deps $img --sbom=go.version-m > gomod.txt
cat gomod.txt
cyclonedx:
name: Validate CycloneDX SBOM
runs-on: ubuntu-latest
env:
KO_DOCKER_REPO: localhost:1338
steps:
- uses: actions/setup-go@v3
with:
go-version: 1.17
check-latest: true
- uses: chainguard-dev/actions/setup-registry@main
- uses: actions/checkout@v3
- name: Install CycloneDX
run: |
wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.22.0/cyclonedx-linux-x64
chmod +x cyclonedx-linux-x64
- name: Generate and Validate
run: |
img=$(go run ./ build ./)
go run ./ deps $img --sbom=cyclonedx > cyclonedx.json
./cyclonedx-linux-x64 validate --input-file=cyclonedx.json --fail-on-errors
- uses: actions/upload-artifact@v3
if: ${{ always() }}
with:
name: cyclonedx.json
path: cyclonedx.json
spdx:
name: Validate SPDX SBOM
runs-on: ubuntu-latest
env:
KO_DOCKER_REPO: localhost:1338
steps:
- uses: actions/setup-go@v3
with:
go-version: 1.17
check-latest: true
- uses: chainguard-dev/actions/setup-registry@main
- uses: actions/checkout@v3
- name: Install SPDX Tools
run: |
wget https://github.com/spdx/tools-java/releases/download/v1.0.4/tools-java-1.0.4.zip
unzip tools-java-1.0.4.zip
- name: Generate and Validate
run: |
img=$(go run ./ build ./)
go run ./ deps $img --sbom=spdx | tee spdx.json
java -jar ./tools-java-1.0.4-jar-with-dependencies.jar Verify spdx.json
- uses: actions/upload-artifact@v3
if: ${{ always() }}
with:
name: spdx.json
path: spdx.json
spdx-multi-arch:
name: Validate SPDX multi-arch SBOM
runs-on: ubuntu-latest
env:
KO_DOCKER_REPO: localhost:1338
steps:
- uses: actions/setup-go@v3
with:
go-version: 1.17
check-latest: true
- uses: chainguard-dev/actions/setup-registry@main
- uses: actions/checkout@v3
- name: Install SPDX Tools
run: |
wget https://github.com/spdx/tools-java/releases/download/v1.0.4/tools-java-1.0.4.zip
unzip tools-java-1.0.4.zip
- name: Install Cosign
uses: sigstore/[email protected]
with:
cosign-release: 'v1.7.2'
- name: Generate and Validate
run: |
img=$(go run ./ build --platform=linux/amd64,linux/arm64 ./)
cosign download sbom $img | tee spdx-multi-arch.json
java -jar ./tools-java-1.0.4-jar-with-dependencies.jar Verify spdx-multi-arch.json
- uses: actions/upload-artifact@v3
if: ${{ always() }}
with:
name: spdx-multi-arch.json
path: spdx-multi-arch.json