graalvm-reachability-metadata/sbom_generation.yaml at master · LesiaChaban/graalvm-reachability-metadata · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
# This OCI DevOps build specification file [1] generates a Software Bill of Materials (SBOM) of the repository.
# The file is needed to run checks for third-party vulnerabilities and business approval according to Oracle’s GitHub policies.
# [1] https://docs.oracle.com/en-us/iaas/Content/devops/using/build_specs.htm
version: 0.1
component: build
timeoutInSeconds: 1000
shell: bash
env:
  variables:
    "JAVA_HOME" : "/usr/lib64/graalvm/graalvm21-ee-java17"
steps:
  - type: Command
    name: "Installing the Oracle GraalVM 21 for JDK 17, jqm and libicu"
    command: |
      yum -y install graalvm21-ee-17-jdk jq libicu
  - type: Command
    name: "Setting the JAVA_PATH"
    command: |
      export PATH=$JAVA_HOME/bin:$PATH
  - type: Command
    name: "Download CycloneDx-cli executable and install dependencies"
    command: |
      wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.2/cyclonedx-linux-x64
  - type: Command
    name: "Run Gradle cyclonedxBom command"
    command: |
      # For more details, visit https://github.com/CycloneDX/cyclonedx-gradle-plugin/blob/master/README.md
      cat <<EOF >> init.gradle
        initscript {
          repositories {
            maven {
              url "https://plugins.gradle.org/m2/"
            }
          }
          dependencies {
            classpath "org.cyclonedx:cyclonedx-gradle-plugin:2.3.1"
          }
        }
        allprojects {
          apply plugin:org.cyclonedx.gradle.CycloneDxPlugin
          cyclonedxBom {
            includeConfigs = ["runtimeClasspath", "compileClasspath"]
            skipConfigs = ["testCompileClasspath"]
            projectType = "application"
            destination = file(".")
            outputName = "artifactSBOM"
            outputFormat = "json"
            schemaVersion = "1.4"
          }
        }
      EOF
      ./gradlew --init-script init.gradle cyclonedxBom -info
  - type: Command
    name: "Run Gradle cyclonedxBom in ./tests/tck-build-logic"
    command: |
      # For more details, visit https://github.com/CycloneDX/cyclonedx-gradle-plugin/blob/master/README.md
      cat <<EOF >> ./tests/tck-build-logic/init.gradle
        initscript {
          repositories {
            maven {
              url "https://plugins.gradle.org/m2/"
            }
          }
          dependencies {
            classpath "org.cyclonedx:cyclonedx-gradle-plugin:2.3.1"
          }
        }
        allprojects {
          apply plugin:org.cyclonedx.gradle.CycloneDxPlugin
          cyclonedxBom {
            includeConfigs = ["runtimeClasspath", "compileClasspath"]
            skipConfigs = ["testCompileClasspath"]
            projectType = "application"
            destination = file(".")
            outputName = "artifactSBOM"
            outputFormat = "json"
            schemaVersion = "1.4"
          }
        }
      EOF
      ./gradlew --init-script init.gradle -p tests/tck-build-logic cyclonedxBom -info

  # This step is optional for when you need to specify the name of your modules
  - type: Command
    name: "Detect the metadata components of the SBOMs"
    command: |
      for path in ./artifactSBOM.json ./tests/tck-build-logic/artifactSBOM.json; do
         jq -r '.metadata.component.purl' "$path" >> ${OCI_PRIMARY_SOURCE_DIR}/metadataComponentPurls.txt;
      done

  - type: Command
    name: "Merge multiple SBOMs using CycloneDX-cli"
    command: |
      # For more details, visit https://github.com/CycloneDX/cyclonedx-cli/blob/main/README.md
      chmod +x cyclonedx-linux-x64
      ./cyclonedx-linux-x64 merge --input-files ./artifactSBOM.json ./tests/tck-build-logic/artifactSBOM.json  --output-file merged-bom.json

outputArtifacts:
  - name: artifactSBOM
    type: BINARY
    location: ${OCI_PRIMARY_SOURCE_DIR}/merged-bom.json
  # This step is optional for when you need to specify the name of your modules
  - name: metadataComponentPurls
    type: BINARY
    location: ${OCI_PRIMARY_SOURCE_DIR}/metadataComponentPurls.txt