diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json new file mode 100644 index 0000000..89813d7 --- /dev/null +++ b/.config/dotnet-tools.json @@ -0,0 +1,18 @@ +{ + "version": 1, + "isRoot": true, + "tools": { + "microsoft.sbom.dotnettool": { + "version": "4.1.4", + "commands": [ + "sbom-tool" + ] + }, + "demaconsulting.spdxtool": { + "version": "2.5.0", + "commands": [ + "spdx-tool" + ] + } + } +} \ No newline at end of file diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml new file mode 100644 index 0000000..8e7efee --- /dev/null +++ b/.github/workflows/build.yaml @@ -0,0 +1,74 @@ +on: + workflow_call: + inputs: + wrapper: + required: true + type: string + vswhere: + required: true + type: string + version: + required: true + type: string + +jobs: + build: + runs-on: ubuntu-24.04 + steps: + + - uses: actions/checkout@v6 + + - name: Setup dotnet + uses: actions/setup-dotnet@v5 + with: + dotnet-version: | + 10.x + + - name: Restore Tools + run: > + dotnet tool restore + + - name: Insert Wrapper + shell: bash + run: | + wget https://github.com/demaconsulting/DotnetToolWrapper/releases/download/${{ inputs.wrapper }}/manifest.spdx.json + wget https://github.com/demaconsulting/DotnetToolWrapper/releases/download/${{ inputs.wrapper }}/DotnetToolWrapper.zip + unzip -o DotnetToolWrapper.zip -d DotnetToolWrapper + cp DotnetToolWrapper/net8.0/*.* pack/tools/net8.0/any + cp DotnetToolWrapper/net9.0/*.* pack/tools/net9.0/any + cp DotnetToolWrapper/net10.0/*.* pack/tools/net10.0/any + + - name: Insert VSWhere + run: | + mkdir pack/win-x86 + wget https://github.com/microsoft/vswhere/releases/download/${{ inputs.vswhere }}/vswhere.exe -O pack/win-x86/vswhere.exe + + - name: Generate SBOM + run: > + dotnet sbom-tool generate + -b pack + -pn DemaConsulting.VSWhereTool + -pv ${{ inputs.version }} + -ps DemaConsulting + -nsb https://DemaConsulting.com/VSWhereTool + -li true + -pm true + + - name: Enhance SBOM + shell: bash + run: | + dotnet spdx-tool run-workflow spdx-workflow.yaml vswhere-version=${{ inputs.vswhere }} + + - name: Create Dotnet Tool + run: | + cd pack + dotnet pack DemaConsulting.VSWhereTool.csproj -p:Version=${{ inputs.version }} -o . + + - name: Upload Artifacts + uses: actions/upload-artifact@v5 + with: + name: build-artifacts + path: | + pack/*.nupkg + pack/_manifest/spdx_2.2/*.* + \ No newline at end of file diff --git a/.github/workflows/build_on_push.yaml b/.github/workflows/build_on_push.yaml index 7c29a81..76521d2 100644 --- a/.github/workflows/build_on_push.yaml +++ b/.github/workflows/build_on_push.yaml @@ -4,33 +4,9 @@ on: [push] jobs: build: - - runs-on: ubuntu-22.04 - - steps: - - - uses: actions/checkout@v4 - - - uses: nuget/setup-nuget@v2 - with: - nuget-version: latest - - - name: Insert Wrapper - run: | - wget https://github.com/demaconsulting/DotnetToolWrapper/releases/download/1.0.0/DotnetToolWrapper.zip - unzip -o DotnetToolWrapper.zip -d pack/tools/net6.0/any - - - name: Insert VSWhere - run: | - wget https://github.com/microsoft/vswhere/releases/download/3.1.7/vswhere.exe -O pack/tools/net6.0/any/vswhere.exe - - - name: Create Dotnet Tool - run: | - cd pack - nuget pack - - - name: Upload asset - uses: actions/upload-artifact@v4 - with: - name: VSWhereTool - path: pack/*.nupkg + name: Build Artifacts + uses: ./.github/workflows/build.yaml + with: + wrapper: "1.2.0" + vswhere: "3.1.7" + version: 0.0.0-run.${{ github.run_number }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6d45b8d..d648a3d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: wrapper: - description: 'Wrapper version (1.0.0)' + description: 'Wrapper version (1.2.0)' required: true vswhere: description: 'VSWhere version (3.1.7)' @@ -23,61 +23,51 @@ on: - publish jobs: + build: + name: Build Artifacts + uses: ./.github/workflows/build.yaml + with: + wrapper: ${{ inputs.wrapper }} + weasyprint: ${{ inputs.weasyprint }} + version: ${{ inputs.version }} + release: - permissions: contents: write packages: write - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 + needs: build + steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - - name: Setup dotnet 8 - uses: actions/setup-dotnet@v4 + - name: Setup dotnet + uses: actions/setup-dotnet@v5 with: dotnet-version: | - 8.x - - - uses: nuget/setup-nuget@v2 - with: - nuget-version: latest - - - name: Insert Wrapper - run: | - wget https://github.com/demaconsulting/DotnetToolWrapper/releases/download/${{ github.event.inputs.wrapper }}/DotnetToolWrapper.zip - unzip -o DotnetToolWrapper.zip -d pack/tools/net6.0/any - - - name: Insert VSWhere - run: | - wget https://github.com/microsoft/vswhere/releases/download/${{ github.event.inputs.vswhere }}/vswhere.exe -O pack/tools/net6.0/any/vswhere.exe - - - name: Create Dotnet Tool - run: | - cd pack - nuget pack -Version ${{ github.event.inputs.version }} + 10.x - - name: Upload Artifacts - uses: actions/upload-artifact@v4 + - name: Download Artifacts + uses: actions/download-artifact@v5 with: - name: artifacts-release - path: | - pack/*.nupkg + name: build-artifacts + path: build-artifacts - name: Create release if: ${{ inputs.publish == 'release' || inputs.publish == 'publish' }} uses: ncipollo/release-action@v1 with: - artifacts: pack/*.nupkg + artifacts: "build-artifacts/*.nupkg,build-artifacts/_manifest/spdx_2.2/*.*" generateReleaseNotes: true - tag: ${{ github.event.inputs.version }} + tag: ${{ inputs.version }} - name: Publish to Nuget if: ${{ inputs.publish == 'publish' }} run: > dotnet nuget push - pack/*.nupkg + build-artifacts/*.nupkg --source "https://api.nuget.org/v3/index.json" --api-key "${{ secrets.DEMACONSULTINGNUGETKEY }}" diff --git a/pack/DemaConsulting.VSWhereTool.csproj b/pack/DemaConsulting.VSWhereTool.csproj new file mode 100644 index 0000000..75a26d8 --- /dev/null +++ b/pack/DemaConsulting.VSWhereTool.csproj @@ -0,0 +1,7 @@ + + + netstandard2.0 + DemaConsulting.VSWhereTool.nuspec + version=$(Version) + + \ No newline at end of file diff --git a/pack/DemaConsulting.VSWhereTool.nuspec b/pack/DemaConsulting.VSWhereTool.nuspec index 425dc08..9cffc9c 100644 --- a/pack/DemaConsulting.VSWhereTool.nuspec +++ b/pack/DemaConsulting.VSWhereTool.nuspec @@ -2,7 +2,7 @@ DemaConsulting.VSWhereTool - 0.0.0 + $version$ VSWhere Dotnet Tool Dema Consulting false @@ -22,5 +22,6 @@ + \ No newline at end of file diff --git a/pack/tools/net6.0/any/DotnetToolSettings.xml b/pack/tools/net10.0/any/DotnetToolSettings.xml similarity index 100% rename from pack/tools/net6.0/any/DotnetToolSettings.xml rename to pack/tools/net10.0/any/DotnetToolSettings.xml diff --git a/pack/tools/net10.0/any/DotnetToolWrapper.json b/pack/tools/net10.0/any/DotnetToolWrapper.json new file mode 100644 index 0000000..6cdfea8 --- /dev/null +++ b/pack/tools/net10.0/any/DotnetToolWrapper.json @@ -0,0 +1,8 @@ +{ + "win-x64": { + "program": "../../../win-x86/vswhere.exe" + }, + "win-x86": { + "program": "../../../win-x86/vswhere.exe" + } +} \ No newline at end of file diff --git a/pack/tools/net6.0/any/DotnetToolWrapper.json b/pack/tools/net6.0/any/DotnetToolWrapper.json deleted file mode 100644 index 11fbb90..0000000 --- a/pack/tools/net6.0/any/DotnetToolWrapper.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "win-x64": { - "program": "vswhere.exe" - } -} \ No newline at end of file diff --git a/pack/tools/net8.0/any/DotnetToolSettings.xml b/pack/tools/net8.0/any/DotnetToolSettings.xml new file mode 100644 index 0000000..72d0f9a --- /dev/null +++ b/pack/tools/net8.0/any/DotnetToolSettings.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/pack/tools/net8.0/any/DotnetToolWrapper.json b/pack/tools/net8.0/any/DotnetToolWrapper.json new file mode 100644 index 0000000..6cdfea8 --- /dev/null +++ b/pack/tools/net8.0/any/DotnetToolWrapper.json @@ -0,0 +1,8 @@ +{ + "win-x64": { + "program": "../../../win-x86/vswhere.exe" + }, + "win-x86": { + "program": "../../../win-x86/vswhere.exe" + } +} \ No newline at end of file diff --git a/pack/tools/net9.0/any/DotnetToolSettings.xml b/pack/tools/net9.0/any/DotnetToolSettings.xml new file mode 100644 index 0000000..72d0f9a --- /dev/null +++ b/pack/tools/net9.0/any/DotnetToolSettings.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/pack/tools/net9.0/any/DotnetToolWrapper.json b/pack/tools/net9.0/any/DotnetToolWrapper.json new file mode 100644 index 0000000..6cdfea8 --- /dev/null +++ b/pack/tools/net9.0/any/DotnetToolWrapper.json @@ -0,0 +1,8 @@ +{ + "win-x64": { + "program": "../../../win-x86/vswhere.exe" + }, + "win-x86": { + "program": "../../../win-x86/vswhere.exe" + } +} \ No newline at end of file diff --git a/spdx-workflow.yaml b/spdx-workflow.yaml new file mode 100644 index 0000000..0322a5d --- /dev/null +++ b/spdx-workflow.yaml @@ -0,0 +1,124 @@ +# This workflow annotates the SBOM for the DemaConsulting.VSWhereTool with +# build tools, and generates a summary markdown. + + +# Workflow Parameters +parameters: + spdx: pack/_manifest/spdx_2.2/manifest.spdx.json + md: pack/_manifest/spdx_2.2/sbom_summary.md + wrapper-spdx: manifest.spdx.json + vswhere-version: 0.0 + +# Steps +steps: + + # Get the VSWhereTool version +- command: get-version + displayName: Get VSWhereTool Version + inputs: + output: vswhere-version + spdx: ${{ spdx }} + name: DemaConsulting.VSWhereTool + + + # Rename the Root Package ID +- command: rename-id + displayName: Rename VSWhereTool Package ID + inputs: + spdx: ${{ spdx }} + old: SPDXRef-RootPackage + new: SPDXRef-DemaConsulting-VSWhereTool-${{ vswhere-version }} + + + # Copy DotnetToolWrapper +- command: copy-package + inputs: + from: ${{ wrapper-spdx }} + to: ${{ spdx }} + package: SPDXRef-DemaConsulting-DotnetToolWrapper + recursive: true + relationships: + - type: CONTAINED_BY + element: SPDXRef-DemaConsulting-VSWhereTool-${{ vswhere-version }} + comment: DotnetToolWrapper embedded into DemaConsulting.VSWhereTool + + + # Add VSWhere Package +- command: add-package + inputs: + spdx: ${{ spdx }} + package: + id: SPDXRef-Package-VSWhereTool-${{ vswhere-version }} + name: VSWhere + download: NOASSERTION + version: ${{ vswhere-version }} + filename: NOASSERTION + supplier: NOASSERTION + originator: NOASSERTION + homepage: https://github.com/microsoft/vswhere + copyright: "Copyright (C) Microsoft Corporation. All rights reserved." + summary: "Locate Visual Studio 2017 and newer installations." + license: MIT + purl: pkg:github/microsoft/vswhere@${{ vswhere-version }} + relationships: + - type: CONTAINED_BY + element: SPDXRef-DemaConsulting-VSWhereTool-${{ vswhere-version }} + comment: VSWhere ${{ vswhere-version }} embedded into DemaConsulting.VSWhereTool + + + # Query for DotNet version +- command: run-workflow + displayName: Query DotNet Version + inputs: + url: https://raw.githubusercontent.com/demaconsulting/SpdxWorkflows/main/GetDotNetVersion.yaml + outputs: + version: dotnet-version + + + # Add DotNet Package +- command: run-workflow + displayName: Add DotNet Package + inputs: + url: https://raw.githubusercontent.com/demaconsulting/SpdxWorkflows/main/AddDotNetPackage.yaml + parameters: + spdx: ${{ spdx }} + version: ${{ dotnet-version }} + id: SPDXRef-Package-DotNet-${{ dotnet-version }} + + + # Add DotNet Relationship +- command: add-relationship + displayName: Add DotNet Relationship + inputs: + spdx: ${{ spdx }} + id: SPDXRef-Package-DotNet-${{ dotnet-version }} + relationships: + - type: BUILD_TOOL_OF + element: SPDXRef-DemaConsulting-VSWhereTool-${{ vswhere-version }} + comment: DotNet ${{ dotnet-version }} used to package DemaConsulting.VSWhereTool + + + # Update the SBOM sha256 +- command: hash + displayName: Update VSWhereTool SBOM sha256 + inputs: + operation: generate + algorithm: sha256 + file: ${{ spdx }} + + + # Validate the SBOM +- command: validate + displayName: Validate VSWhereTool SBOM + inputs: + spdx: ${{ spdx }} + ntia: true + + + # Generate the library summary +- command: to-markdown + displayName: Generate VSWhereTool SBOM summary + inputs: + spdx: ${{ spdx }} + markdown: ${{ md }} + title: VSWhereTool