mirror of
https://github.com/ko-build/ko.git
synced 2026-06-18 20:14:08 +02:00
dependabot[bot]
09e4bae463
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/c7d193f32edcb7bfad88892161225aeda64e9392...1eb3cb2b3e0f29609092a73eb033bb759a334595) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
110 lines
3.6 KiB
YAML
110 lines
3.6 KiB
YAML
name: Validate SBOMs
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- 'main'
|
|
|
|
env:
|
|
SPDX_TOOLS_VERSION: 1.1.0
|
|
|
|
jobs:
|
|
cyclonedx:
|
|
name: Validate CycloneDX SBOM
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
KO_DOCKER_REPO: localhost:1338
|
|
|
|
steps:
|
|
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
|
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
check-latest: true
|
|
- uses: chainguard-dev/actions/setup-registry@main
|
|
- uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
|
|
|
|
- name: Install CycloneDX
|
|
run: |
|
|
wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.22.0/cyclonedx-linux-x64
|
|
chmod +x cyclonedx-linux-x64
|
|
|
|
- name: Generate and Validate
|
|
run: |
|
|
cosign download sbom $(go run ./ build --sbom=cyclonedx) | tee cyclonedx.json
|
|
./cyclonedx-linux-x64 validate --input-file=cyclonedx.json --fail-on-errors
|
|
|
|
- uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
|
|
if: ${{ always() }}
|
|
with:
|
|
name: cyclonedx.json
|
|
path: cyclonedx.json
|
|
|
|
spdx:
|
|
name: Validate SPDX SBOM
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
KO_DOCKER_REPO: localhost:1338
|
|
|
|
steps:
|
|
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
|
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
check-latest: true
|
|
- uses: chainguard-dev/actions/setup-registry@main
|
|
- uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
|
|
|
|
- name: Install SPDX Tools
|
|
run: |
|
|
wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
|
|
unzip tools-java-${SPDX_TOOLS_VERSION}.zip
|
|
|
|
- name: Generate and Validate
|
|
run: |
|
|
cosign download sbom $(go run ./ build) | tee spdx.json
|
|
java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx.json
|
|
|
|
- uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
|
|
if: ${{ always() }}
|
|
with:
|
|
name: spdx.json
|
|
path: spdx.json
|
|
|
|
spdx-multi-arch:
|
|
name: Validate SPDX multi-arch SBOM
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
KO_DOCKER_REPO: localhost:1338
|
|
|
|
steps:
|
|
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
|
|
|
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
check-latest: true
|
|
- uses: chainguard-dev/actions/setup-registry@main
|
|
- uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
|
|
|
|
- name: Install SPDX Tools
|
|
run: |
|
|
wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
|
|
unzip tools-java-${SPDX_TOOLS_VERSION}.zip
|
|
|
|
- name: Generate and Validate
|
|
run: |
|
|
img=$(go run ./ build --platform=linux/amd64,linux/arm64)
|
|
cosign download sbom $img | tee spdx-multi-arch.json
|
|
|
|
java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx-multi-arch.json
|
|
|
|
- uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
|
|
if: ${{ always() }}
|
|
with:
|
|
name: spdx-multi-arch.json
|
|
path: spdx-multi-arch.json
|