Bump wincode from 0.6.0 to 0.6.1 #2270
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # stub to call common GitHub Action (GA) as part of Continuous Integration (CI) Pull Request process checks for main branch | |
| # inputs are described in the chef/common-github-actions/<GA.yml> with same name as this stub | |
| # | |
| # secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL, GH_TOKEN, AKEYLESS_JWT_ID, POLARIS_SERVER_URL and POLARIS_ACCESS_TOKEN | |
| name: CI Pull Request on Main Branch | |
| on: | |
| pull_request: | |
| branches: [ main, release/** ] | |
| push: | |
| branches: [ main, release/** ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| STUB_VERSION: "1.0.5" | |
| jobs: | |
| echo_version: | |
| name: 'Echo stub version' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: echo version of stub and inputs | |
| run: | | |
| echo "CI main pull request stub version $STUB_VERSION" | |
| call-ci-main-pr-check-pipeline: | |
| uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main | |
| secrets: inherit | |
| permissions: | |
| id-token: write | |
| contents: read | |
| with: | |
| visibility: ${{ github.event.repository.visibility }} # private, public, or internal | |
| # go-private-modules: GOPRIVATE for Go private modules, default is 'github.com/progress-platform-services/* | |
| # if version specified, it takes precedence; can be a semver like 1.0.2-xyz or a tag like "latest" | |
| version: '' # read from file below | |
| detect-version-source-type: 'file' # options include "none" (do not detect), "file", "github-tag" or "github-release" | |
| detect-version-source-parameter: 'VERSION' # VERSION file in repo root | |
| language: 'rust' # Go, Ruby, Rust, JavaScript, TypeScript, Python, Java, C#, PHP, other - used for build and SonarQube language setting | |
| # complexity-checks | |
| perform-complexity-checks: true | |
| # scc-output-filename: 'scc-output.txt' | |
| perform-language-linting: false # Perform language-specific linting and pre-compilation checks | |
| # trufflehog secret scanning | |
| perform-trufflehog-scan: true | |
| # trivy dependency and container scanning | |
| # Commenting out trivy scan for now as it is causing some issues and we want to get the rest of the pipeline working; will re-enable in future PRs | |
| # perform-trivy-scan: true | |
| # BlackDuck SAST (Polaris) and SCA scans (requires a build or download to do SAST) | |
| # requires these secrets: POLARIS_SERVER_URL, POLARIS_ACCESS_TOKEN | |
| perform-blackduck-polaris: false | |
| polaris-application-name: "Chef-Habitat" # one of these: Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Other, Chef-Non-Product | |
| polaris-project-name: ${{ github.event.repository.name }} | |
| polaris-blackduck-executable: 'path/to/blackduck/binary' | |
| polaris-executable-detect-path: 'path/to/detect' | |
| # perform application build and unit testing, will use custom repository properties when implemented for chef-primary-application, chef-build-profile, and chef-build-language | |
| build: false | |
| # ga-build-profile: $chef-ga-build-profile | |
| # language: $chef-ga-build-language # this will be removed from stub as autodetected in central GA | |
| unit-tests: false | |
| # perform SonarQube scan, with or wihout unit test coverage data | |
| # requires secrets SONAR_TOKEN and SONAR_HOST_URL (progress.sonar.com) | |
| perform-sonarqube-scan: false | |
| # perform-sonar-build: true | |
| # build-profile: 'default' | |
| # report-unit-test-coverage: true | |
| perform-docker-scan: false # scan Dockerfile and built images with Docker Scout or Trivy; see repo custom properties matching "container" | |
| # report to central developer dashboard | |
| report-to-atlassian-dashboard: false | |
| quality-product-name: 'Chef-Habitat' # product name for quality reporting, like Chef360, Courier, Inspec | |
| # quality-product-name: ${{ github.event.repository.name }} # like 'Chef-360' - the product name for quality reporting, like Chef360, Courier, Inspec | |
| # quality-sonar-app-name: 'YourSonarAppName' | |
| # quality-testing-type: 'Integration' like Unit, Integration, e2e, api, Performance, Security | |
| # quality-service-name: 'YourServiceOrRepoName' | |
| # quality-junit-report: 'path/to/junit/report'' | |
| # perform native and Habitat packaging, publish to package repositories | |
| package-binaries: false # Package binaries (e.g., RPM, DEB, MSI, dpkg + signing + SHA) | |
| habitat-build: false # Create Habitat packages | |
| publish-packages: false # Publish packages (e.g., container from Dockerfile to ECR, go-releaser binary to releases page, omnibus to artifactory, gems, choco, homebrew, other app stores) | |
| # generate and export Software Bill of Materials (SBOM) in various formats | |
| generate-sbom: true | |
| export-github-sbom: true # SPDX JSON artifact on job instance | |
| perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above | |
| blackduck-project-group-name: 'Chef-Habitat' # typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product' | |
| blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name | |
| generate-blackduck-sbom: true # obsolete, use perform-blackduck-sca-scan instead | |
| generate-msft-sbom: false | |
| license_scout: false # Run license scout for license compliance (uses .license_scout.yml) | |
| # udf1: 'default' # user defined flag 1 | |
| # udf2: 'default' # user defined flag 2 | |
| # udf3: 'default' # user defined flag 3 | |
| # --------------------------------------------------------------------------- | |
| # Multi-platform SBOM generation + BlackDuck import | |
| # | |
| # Motivation: BlackDuck Detect runs `cargo tree` on the CI host (Linux x86_64) | |
| # which misses three categories of dependencies: | |
| # 1. Platform-conditional deps (windows-sys, objc2-*, wasi, core-foundation, etc.) | |
| # 2. Rust stdlib-bundled deps (backtrace, addr2line, gimli, object, rustc-demangle) | |
| # 3. Optional feature-gated deps that happen to be resolved in Cargo.lock | |
| # but not active in the default build | |
| # | |
| # This job generates a CycloneDX SBOM via `cargo-cyclonedx` for each shipped | |
| # target triple, merges them, and imports the result into BlackDuck so those | |
| # components appear in the same project version the SCA scan created. | |
| # | |
| # Runs after the main pipeline so it can target the same BD project/version. | |
| # --------------------------------------------------------------------------- | |
| generate-multi-platform-sbom: | |
| name: 'Generate Multi-Platform SBOM and Import to BlackDuck' | |
| runs-on: ubuntu-latest | |
| # Run after the main pipeline so BlackDuck has already created the project version. | |
| # NOTE: needs: is intentionally omitted here because GitHub Actions skips jobs that | |
| # depend on reusable workflow call jobs when triggered via workflow_dispatch. | |
| # This job still runs on PRs to generate the SBOM artifact for review. | |
| # Only the later BlackDuck import step is conditionally gated to push/merge events. | |
| env: | |
| # Match the project name used by call-ci-main-pr-check-pipeline above | |
| BD_PROJECT_NAME: ${{ github.event.repository.name }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set BD_VERSION_NAME from VERSION file | |
| run: echo "BD_VERSION_NAME=$(cat VERSION)" >> "$GITHUB_ENV" | |
| # Read the pinned toolchain from rust-toolchain at the repo root so we | |
| # don't have to hardcode the version here. | |
| - name: Read Rust toolchain version | |
| id: rust-version | |
| run: | | |
| echo "toolchain=$(grep ^channel rust-toolchain | cut -d'"' -f2)" >> "$GITHUB_OUTPUT" | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@master | |
| id: toolchain | |
| with: | |
| toolchain: ${{ steps.rust-version.outputs.toolchain }} | |
| - run: rustup override set ${{ steps.toolchain.outputs.name }} | |
| # Install target triples we ship for. | |
| # Note: cross-compilation is NOT required here — cargo-cyclonedx uses | |
| # `cargo metadata --filter-platform` which only needs the target registered, | |
| # not a full cross toolchain. | |
| - name: Install target triples | |
| run: | | |
| rustup target add \ | |
| x86_64-unknown-linux-gnu \ | |
| aarch64-unknown-linux-gnu \ | |
| x86_64-pc-windows-msvc \ | |
| aarch64-apple-darwin \ | |
| x86_64-apple-darwin | |
| - name: Install cargo-cyclonedx | |
| uses: ClementTsang/cargo-action@v0.0.7 | |
| with: | |
| command: install | |
| args: cargo-cyclonedx --locked | |
| # Download the CycloneDX CLI used to merge the per-target SBOMs | |
| - name: Install CycloneDX CLI | |
| run: | | |
| curl -sSL https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64 \ | |
| -o /usr/local/bin/cyclonedx-cli | |
| chmod +x /usr/local/bin/cyclonedx-cli | |
| # Generate one SBOM per target. cargo-cyclonedx reads Cargo.lock and | |
| # filters deps via `cargo metadata --filter-platform`, so each file only | |
| # contains deps that are active for that target. | |
| # --all processes every workspace member; --target-in-filename ensures each | |
| # target's output files don't overwrite each other (produces bom.<target>.cdx.json | |
| # in each member's directory). | |
| - name: Generate SBOM — Linux x86_64 | |
| run: cargo cyclonedx --all --format json --target x86_64-unknown-linux-gnu --target-in-filename | |
| - name: Generate SBOM — Linux aarch64 | |
| run: cargo cyclonedx --all --format json --target aarch64-unknown-linux-gnu --target-in-filename | |
| - name: Generate SBOM — Windows x86_64 | |
| run: cargo cyclonedx --all --format json --target x86_64-pc-windows-msvc --target-in-filename | |
| - name: Generate SBOM — macOS aarch64 | |
| run: cargo cyclonedx --all --format json --target aarch64-apple-darwin --target-in-filename | |
| - name: Generate SBOM — macOS x86_64 | |
| run: cargo cyclonedx --all --format json --target x86_64-apple-darwin --target-in-filename | |
| # Dynamically generate a CycloneDX fragment for third-party sysroot crates. | |
| # These are statically linked into every Rust binary but invisible to | |
| # cargo metadata / cargo tree because they are pre-compiled into the sysroot. | |
| # The script discovers them by intersecting the sysroot rlib files with the | |
| # workspace Cargo.lock. | |
| - name: Generate stdlib sysroot SBOM fragment | |
| run: bash support/sbom/generate-stdlib-fragment.sh > stdlib-sysroot.cdx.json | |
| # Merge all per-target SBOMs plus the sysroot fragment into one | |
| # deduplicated CycloneDX document. | |
| # cargo cyclonedx writes one *.cdx.json per workspace member per target into | |
| # each member's directory. We use find to collect them all, excluding the | |
| # target/ build directory. | |
| - name: Merge SBOMs | |
| run: | | |
| SBOM_FILES=$(find . -name "*.cdx.json" -not -path "*/target/*" -not -name "stdlib-sysroot.cdx.json" | sort | tr '\n' ' ') | |
| echo "Merging files: $SBOM_FILES stdlib-sysroot.cdx.json support/sbom/habitat-core-deps.cyclonedx.json" | |
| cyclonedx-cli merge \ | |
| --input-files $SBOM_FILES stdlib-sysroot.cdx.json support/sbom/habitat-core-deps.cyclonedx.json \ | |
| --output-file sbom-all-platforms.json \ | |
| --output-format json \ | |
| --output-version v1_4 | |
| # Inject a version-based serialNumber and the current version so BlackDuck | |
| # treats each release upload as a distinct scan (prevents "already mapped" errors). | |
| # Also strip first-party Habitat crates: | |
| # - names starting with "habitat" (except "Habitat core_" origin packages) | |
| # - explicitly excluded first-party crates: hab, hab-common-derive, test-probe | |
| jq --arg serial "urn:uuid:habitat-${BD_VERSION_NAME}" --arg ver "$BD_VERSION_NAME" \ | |
| '.serialNumber = $serial | |
| | .metadata.component.version = $ver | |
| | .components = [.components[] | select( | |
| (.name | ascii_downcase | startswith("habitat core_")) or | |
| ( | |
| (.name | ascii_downcase | startswith("habitat") | not) and | |
| ([.name] | inside(["hab","hab-common-derive","test-probe"]) | not) | |
| ) | |
| )]' \ | |
| sbom-all-platforms.json > sbom-versioned.json | |
| mv sbom-versioned.json sbom-all-platforms.json | |
| echo "Components after filtering: $(jq '.components|length' sbom-all-platforms.json)" | |
| # Always upload the merged SBOM as an artifact for auditing/review | |
| - name: Upload merged SBOM artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: cyclonedx-sbom-all-platforms | |
| path: sbom-all-platforms.json | |
| retention-days: 90 | |
| # Import the merged SBOM into the same BlackDuck project/version that | |
| # the SCA scan above already created, so the additional platform-specific | |
| # and stdlib deps appear in the same BOM. | |
| # | |
| # Required secrets (already present in repo/org): | |
| # BLACKDUCK_SBOM_URL — e.g. https://your-instance.blackducksoftware.com | |
| # BLACKDUCK_SCA_TOKEN — a BlackDuck personal access token with BOM write rights | |
| - name: Import SBOM into BlackDuck | |
| if: github.event_name != 'pull_request' | |
| env: | |
| BLACKDUCK_URL: ${{ secrets.BLACKDUCK_SBOM_URL }} | |
| BLACKDUCK_API_TOKEN: ${{ secrets.BLACKDUCK_SCA_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| # Authenticate and obtain a short-lived bearer token | |
| BEARER=$(curl -sSf -X POST \ | |
| "${BLACKDUCK_URL}/api/tokens/authenticate" \ | |
| -H "Authorization: token ${BLACKDUCK_API_TOKEN}" \ | |
| -H "Accept: application/vnd.blackducksoftware.user-4+json" \ | |
| | jq -r '.bearerToken') | |
| if [ -z "${BEARER}" ] || [ "${BEARER}" = "null" ]; then | |
| echo "ERROR: Failed to obtain bearer token." | |
| exit 1 | |
| fi | |
| # URL-encode BD_PROJECT_NAME and BD_VERSION_NAME for use in query strings. | |
| # BD_VERSION_NAME comes from the VERSION file and may contain '+' (semver | |
| # build metadata) or other reserved characters. | |
| BD_PROJECT_ENCODED=$(printf '%s' "${BD_PROJECT_NAME}" | jq -sRr @uri) | |
| BD_VERSION_ENCODED=$(printf '%s' "${BD_VERSION_NAME}" | jq -sRr @uri) | |
| # Look up the project by exact name (BD search is substring, so we filter client-side) | |
| PROJECT_BODY=$(curl -sSf \ | |
| "${BLACKDUCK_URL}/api/projects?q=name:${BD_PROJECT_ENCODED}&limit=10" \ | |
| -H "Authorization: Bearer ${BEARER}" \ | |
| -H "Accept: application/vnd.blackducksoftware.project-detail-4+json") | |
| PROJECT_HREF=$(echo "${PROJECT_BODY}" | jq -r \ | |
| --arg name "${BD_PROJECT_NAME}" \ | |
| '.items[] | select(.name == $name) | ._meta.href' | head -1) | |
| if [ -z "${PROJECT_HREF}" ] || [ "${PROJECT_HREF}" = "null" ]; then | |
| echo "ERROR: BlackDuck project '${BD_PROJECT_NAME}' not found." | |
| echo "Available matches: $(echo "${PROJECT_BODY}" | jq -r '.items[].name')" | |
| exit 1 | |
| fi | |
| # Look up the project version by exact name; create it if it doesn't exist yet | |
| VERSION_BODY=$(curl -sSf \ | |
| "${PROJECT_HREF}/versions?q=versionName:${BD_VERSION_ENCODED}&limit=10" \ | |
| -H "Authorization: Bearer ${BEARER}" \ | |
| -H "Accept: application/vnd.blackducksoftware.project-detail-5+json") | |
| VERSION_HREF=$(echo "${VERSION_BODY}" | jq -r \ | |
| --arg ver "${BD_VERSION_NAME}" \ | |
| '.items[] | select(.versionName == $ver) | ._meta.href' | head -1) | |
| if [ -z "${VERSION_HREF}" ] || [ "${VERSION_HREF}" = "null" ]; then | |
| echo "Version '${BD_VERSION_NAME}' not found — creating it..." | |
| VERSION_HREF=$(curl -sS -o /tmp/bd_create_resp.json -w "%{header_json}" -X POST \ | |
| "${PROJECT_HREF}/versions" \ | |
| -H "Authorization: Bearer ${BEARER}" \ | |
| -H "Content-Type: application/vnd.blackducksoftware.project-detail-4+json" \ | |
| -H "Accept: application/vnd.blackducksoftware.project-detail-5+json" \ | |
| -d "{\"versionName\":\"${BD_VERSION_NAME}\",\"phase\":\"DEVELOPMENT\",\"distribution\":\"EXTERNAL\"}" \ | |
| | jq -r '.location[0] // empty') | |
| # Prefer Location header; fall back to re-fetching the version href | |
| if [ -z "${VERSION_HREF}" ]; then | |
| VERSION_HREF=$(curl -sSf \ | |
| "${PROJECT_HREF}/versions?q=versionName:${BD_VERSION_ENCODED}&limit=10" \ | |
| -H "Authorization: Bearer ${BEARER}" \ | |
| -H "Accept: application/vnd.blackducksoftware.project-detail-5+json" \ | |
| | jq -r --arg ver "${BD_VERSION_NAME}" \ | |
| '.items[] | select(.versionName == $ver) | ._meta.href' | head -1) | |
| fi | |
| if [ -z "${VERSION_HREF}" ] || [ "${VERSION_HREF}" = "null" ]; then | |
| echo "ERROR: Failed to create or locate BlackDuck version '${BD_VERSION_NAME}'." | |
| echo "Create response: $(cat /tmp/bd_create_resp.json)" | |
| exit 1 | |
| fi | |
| echo "Created version: ${VERSION_HREF}" | |
| fi | |
| echo "Uploading SBOM ($(jq '.components|length' sbom-all-platforms.json) components) to project '${BD_PROJECT_NAME}' version '${BD_VERSION_NAME}'" | |
| # POST /api/scan/data as multipart/form-data per BD API spec. | |
| # projectName, versionName, and autocreate are form parts, not query params. | |
| # Content type for the file part must be application/vnd.cyclonedx (no +json). | |
| HTTP_STATUS=$(curl -sS -o /tmp/bd_upload_resp.json -w "%{http_code}" -X POST \ | |
| "${BLACKDUCK_URL}/api/scan/data" \ | |
| -H "Authorization: Bearer ${BEARER}" \ | |
| -F "file=@sbom-all-platforms.json;type=application/vnd.cyclonedx" \ | |
| -F "projectName=${BD_PROJECT_NAME}" \ | |
| -F "versionName=${BD_VERSION_NAME}" \ | |
| -F "autocreate=true") | |
| echo "BlackDuck SBOM upload HTTP status: ${HTTP_STATUS}" | |
| if [[ "${HTTP_STATUS}" != "2"* ]]; then | |
| echo "ERROR: SBOM upload failed with HTTP ${HTTP_STATUS}" | |
| echo "Response: $(cat /tmp/bd_upload_resp.json)" | |
| exit 1 | |
| fi | |
| echo "SBOM upload complete. Components will appear in BlackDuck after async processing." |