Skip to content

Commit 9ba67f5

Browse files
mpreyskurantovmpreyskurantov
committed
sbom
1 parent 7686bb6 commit 9ba67f5

7 files changed

Lines changed: 1981 additions & 2 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010

1111
permissions:
1212
contents: read
13+
packages: read
1314
id-token: write
1415

1516
jobs:
@@ -41,5 +42,42 @@ jobs:
4142
- name: Build devextreme-schematics
4243
run: pnpm --filter devextreme-schematics run build
4344

44-
- name: Publish packages
45-
run: pnpm --filter './packages/*' publish --provenance ${{ inputs['dry-run'] && '--dry-run' || '' }}
45+
- name: Pack packages
46+
shell: bash
47+
run: |
48+
mkdir -p artifacts/npm
49+
50+
package_cli_tgz="$(pnpm --filter devextreme-cli pack --json --pack-destination artifacts/npm | jq -er '.filename')"
51+
package_schematics_tgz="$(pnpm --filter devextreme-schematics pack --json --pack-destination artifacts/npm | jq -er '.filename')"
52+
53+
echo "PACKAGE_CLI_TGZ=$package_cli_tgz" >> "$GITHUB_ENV"
54+
echo "PACKAGE_SCHEMATICS_TGZ=$package_schematics_tgz" >> "$GITHUB_ENV"
55+
56+
- name: Upload packages
57+
uses: actions/upload-artifact@v7
58+
with:
59+
name: packages
60+
path: artifacts/npm/*.tgz
61+
if-no-files-found: error
62+
retention-days: 1
63+
64+
- name: Build SBOMs
65+
env:
66+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67+
run: |
68+
pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN"
69+
cd tools/make-sbom && pnpm install --frozen-lockfile && pnpm run make-sbom-hashed
70+
71+
- name: Upload SBOMs
72+
uses: actions/upload-artifact@v7
73+
with:
74+
name: sbom
75+
path: tools/make-sbom/dist
76+
if-no-files-found: error
77+
retention-days: 1
78+
79+
- name: Publish devextreme-schematics
80+
run: pnpm publish "$PACKAGE_SCHEMATICS_TGZ" --provenance ${{ inputs['dry-run'] && '--dry-run' || '' }}
81+
82+
- name: Publish devextreme-cli
83+
run: pnpm publish "$PACKAGE_CLI_TGZ" --provenance ${{ inputs['dry-run'] && '--dry-run' || '' }}

‎.github/workflows/sbom.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: SBOM
2+
3+
on:
4+
push:
5+
branches:
6+
- sbom-dev
7+
8+
permissions:
9+
contents: read
10+
packages: read
11+
12+
jobs:
13+
sbom:
14+
if: ${{ github.event_name == 'push' && github.ref_type == 'branch' && github.ref_name == 'sbom-dev' }}
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Get sources
19+
uses: actions/checkout@v4
20+
21+
- name: Install pnpm
22+
uses: pnpm/action-setup@v6
23+
24+
- name: Use Node.js
25+
uses: actions/setup-node@v4
26+
with:
27+
node-version-file: '.node-version'
28+
cache: 'pnpm'
29+
registry-url: 'https://registry.npmjs.org'
30+
31+
- name: Install dependencies
32+
run: pnpm install --frozen-lockfile
33+
34+
- name: Test devextreme-schematics
35+
run: pnpm --filter devextreme-schematics run test
36+
37+
- name: Build devextreme-schematics
38+
run: pnpm --filter devextreme-schematics run build
39+
40+
- name: Pack packages
41+
shell: bash
42+
run: |
43+
mkdir -p artifacts/npm
44+
45+
package_cli_tgz="$(pnpm --filter devextreme-cli pack --json --pack-destination artifacts/npm | jq -er '.filename')"
46+
package_schematics_tgz="$(pnpm --filter devextreme-schematics pack --json --pack-destination artifacts/npm | jq -er '.filename')"
47+
48+
echo "PACKAGE_CLI_TGZ=$package_cli_tgz" >> "$GITHUB_ENV"
49+
echo "PACKAGE_SCHEMATICS_TGZ=$package_schematics_tgz" >> "$GITHUB_ENV"
50+
51+
- name: Upload packages
52+
uses: actions/upload-artifact@v7
53+
with:
54+
name: packages
55+
path: artifacts/npm/*.tgz
56+
if-no-files-found: error
57+
retention-days: 1
58+
59+
- name: Build SBOMs
60+
env:
61+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
62+
run: |
63+
pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN"
64+
cd tools/make-sbom && pnpm install --frozen-lockfile && pnpm run make-sbom-hashed
65+
66+
- name: Upload SBOMs
67+
uses: actions/upload-artifact@v7
68+
with:
69+
name: sbom
70+
path: tools/make-sbom/dist
71+
if-no-files-found: error
72+
retention-days: 1
73+

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
**/npm-debug.log*
1010
**/pnpm-debug.log*
1111
**/yarn-error.log*
12+
dist/
1213
packages/devextreme-cli/testing/sandbox/
1314
packages/devextreme-cli/testing/__tests__/__diff_snapshots__/
1415

‎tools/make-sbom/.npmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@devexpress:registry=https://npm.pkg.github.com

‎tools/make-sbom/package.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"name": "devextreme-cli-monorepo-sbom",
3+
"version": "1.2.7",
4+
"packageManager": "pnpm@11.5.1",
5+
"private": true,
6+
"devDependencies": {
7+
"@devexpress/sbom-toolkit": "0.11.1"
8+
},
9+
"scripts": {
10+
"make-sbom": "rm -rf dist/ && pnpm dx-make-sbom ../../ dist/ devextreme-schematics,devextreme-cli",
11+
"make-sbom-hashed": "pnpm dx-make-sbom ../../ dist/ devextreme-cli(../../artifacts/npm/$PACKAGE_CLI_TGZ),devextreme-schematics(../../artifacts/npm/$PACKAGE_SCHEMATICS_TGZ)"
12+
}
13+
}

0 commit comments

Comments
 (0)