Skip to content

Commit b3a3437

Browse files
VinnyBartonVinnyBarton
authored
Merge pull request #12 from shiftleftcyber/feat/enhanedWorkflows
feat: add new workflows
2 parents ef941cb + 94ff3a1 commit b3a3437

File tree

7 files changed

+168
-89
lines changed

7 files changed

+168
-89
lines changed

‎.github/workflows/build.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Build & Test
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
workflow_dispatch:
8+
9+
jobs:
10+
build:
11+
name: 🧩 Build & Test
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- name: Set up Go
18+
uses: actions/setup-go@v5
19+
with:
20+
go-version-file: 'go.mod'
21+
cache: true
22+
23+
- name: Install Dependencies
24+
run: go mod download
25+
26+
- name: Build
27+
run: |
28+
go version
29+
go build -o bin/sbom-validator-example example/main.go
30+
31+
- name: Run Tests
32+
run: |
33+
go test -v -coverprofile=coverage.out ./...
34+
go tool cover -func=coverage.out
35+
36+
- name: Upload Coverage Report
37+
uses: actions/upload-artifact@v4
38+
with:
39+
name: coverage-report
40+
path: coverage.out
41+
42+
- name: Add Job Summary
43+
run: |
44+
echo "### ✅ Build & Test Completed" >> $GITHUB_STEP_SUMMARY
45+
echo "- ✅ Unit tests passed successfully" >> $GITHUB_STEP_SUMMARY
46+
echo "- 📊 Coverage Summary:" >> $GITHUB_STEP_SUMMARY
47+
go tool cover -func=coverage.out | tail -n 1 >> $GITHUB_STEP_SUMMARY

‎.github/workflows/go.yml‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎.github/workflows/goreleaser.yml‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎.github/workflows/golangci-lint.yml‎ renamed to ‎.github/workflows/lint.yml‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,35 @@
11
name: golangci-lint
2+
23
on:
34
push:
4-
branches:
5-
- main
6-
- master
5+
branches: [ main ]
76
pull_request:
7+
workflow_dispatch:
88

99
permissions:
1010
contents: read
1111

1212
jobs:
13-
golangci:
14-
name: lint
13+
lint:
14+
name: 🔍 Lint
1515
runs-on: ubuntu-latest
16+
1617
steps:
1718
- uses: actions/checkout@v4
18-
- uses: actions/setup-go@v4
19+
- uses: actions/setup-go@v5
1920
with:
2021
go-version-file: 'go.mod'
2122
cache: true
22-
23+
2324
- name: Install Dependencies
24-
run: |
25-
go mod download
26-
27-
- name: golangci-lint
25+
run: go mod download
26+
27+
- name: Run golangci-lint
2828
uses: golangci/golangci-lint-action@v6
2929
with:
3030
version: v1.60
31+
32+
- name: Add Job Summary
33+
run: |
34+
echo "### 🔍 Lint Results" >> $GITHUB_STEP_SUMMARY
35+
echo "- ✅ Code linting completed successfully" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/release.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: GoReleaser
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
goreleaser:
13+
name: 🚀 Release
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Checkout Repository
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 0
21+
22+
- name: Setup Go
23+
uses: actions/setup-go@v5
24+
with:
25+
go-version: "1.21"
26+
check-latest: true
27+
28+
- name: Run GoReleaser
29+
uses: goreleaser/goreleaser-action@v6
30+
with:
31+
version: latest
32+
args: release --clean
33+
env:
34+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
36+
- name: Upload Signed SBOM to Release
37+
uses: softprops/action-gh-release@v2
38+
with:
39+
files: |
40+
sbom-validator.${{ github.ref_name }}.cdx.signed.json
41+
42+
- name: Add Job Summary
43+
run: |
44+
echo "### 🚀 Release Completed" >> $GITHUB_STEP_SUMMARY
45+
echo "- ✅ GoReleaser successfully published binaries and SBOM" >> $GITHUB_STEP_SUMMARY
46+
echo "- 🔏 Signed SBOM attached to GitHub release" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/sbom-sign-verify.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: SBOM Generation, Signing, and Verification
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [ main ]
7+
tags:
8+
- 'v*'
9+
10+
jobs:
11+
sbom-sign-verify:
12+
name: 🔏 SBOM Lifecycle
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Set up Go
19+
uses: actions/setup-go@v5
20+
with:
21+
go-version-file: 'go.mod'
22+
cache: true
23+
24+
- name: Generate SBOM (CycloneDX)
25+
uses: CycloneDX/gh-gomod-generate-sbom@v2
26+
with:
27+
version: v1
28+
args: mod -licenses -json -output-version 1.6 -output sbom-validator.${{ github.ref_name }}.cdx.json
29+
30+
- name: Sign SBOM
31+
uses: shiftleftcyber/secure-sbom-action@v1.3.1
32+
with:
33+
sbom_file: sbom-validator.${{ github.ref_name }}.cdx.json
34+
secure_sbom_action: sign
35+
api_key: ${{ secrets.SECURE_SBOM_API_KEY }}
36+
key_id: ${{ secrets.SECURE_SBOM_KEYID }}
37+
38+
- name: Verify SBOM
39+
uses: shiftleftcyber/secure-sbom-action@v1.3.1
40+
with:
41+
sbom_file: sbom-validator.${{ github.ref_name }}.cdx.signed.json
42+
secure_sbom_action: verify
43+
api_key: ${{ secrets.SECURE_SBOM_API_KEY }}
44+
key_id: ${{ secrets.SECURE_SBOM_KEYID }}
45+
46+
- name: Upload SBOM Artifacts
47+
uses: actions/upload-artifact@v4
48+
with:
49+
name: sbom-artifacts
50+
path: |
51+
sbom-validator.${{ github.ref_name }}.cdx.json
52+
sbom-validator.${{ github.ref_name }}.cdx.signed.json
53+
54+
- name: Add Job Summary
55+
run: |
56+
echo "### 🔏 SBOM Lifecycle Completed" >> $GITHUB_STEP_SUMMARY
57+
echo "- ✅ SBOM generated, signed, and verified successfully" >> $GITHUB_STEP_SUMMARY
58+
echo "- 📄 Artifacts uploaded for transparency" >> $GITHUB_STEP_SUMMARY

‎sample-sboms/sample-1.6.cdx.signed.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"bomFormat":"CycloneDX","components":[{"licenses":[{"license":{"id":"MIT"}}],"name":"example-library","purl":"pkg:maven/org.example/example-library@2.0.0","type":"library","version":"2.0.0"}],"dependencies":[{"dependsOn":[],"ref":"pkg:maven/org.example/example-library@2.0.0"}],"metadata":{"component":{"name":"Example Application","type":"application","version":"1.0.0"},"timestamp":"2024-10-22T12:00:00Z","tools":[{"name":"SBOM Generator","vendor":"ACME Corp","version":"1.0.0"}]},"serialNumber":"urn:uuid:123e4567-e89b-12d3-a456-426614174000","signature":{"algorithm":"ES256","value":"MEQCIDuKdTJ2YFDFWPWbBZyg5p5pkTwrVc40bNdPsBkMhCnTAiBdh91Q24zoItU7m9bhdEFXGFGS4UVGa5MjtZzQOcMyKw=="},"specVersion":"1.6","version":1}

0 commit comments

Comments
 (0)