v2.10.0 #83
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SBOM | |
| on: | |
| release: | |
| types: [published] | |
| permissions: | |
| contents: read | |
| jobs: | |
| generate-sboms: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ^26.3.0 | |
| # Disable caching in release workflows (https://docs.zizmor.sh/audits/#cache-poisoning). | |
| # Zizmor didn't actually warn about this, but its general advice | |
| # was to avoid caching in workflows that publish artifacts. While | |
| # the published SBOM.zip does not include executable code, it is | |
| # still a published artifact. | |
| package-manager-cache: false | |
| - name: Bootstrap | |
| run: npm ci --ignore-scripts | |
| - name: Generate SBOM for core packages | |
| if: ${{ ! startsWith(github.ref, 'refs/tags/experimental') && ! startsWith(github.ref, 'refs/tags/api') }} | |
| run: | | |
| for dir in $(find packages -mindepth 1 -maxdepth 1 -type d) | |
| do | |
| dir_name=$(basename "$dir") | |
| echo "Generating SBOM for $dir_name" | |
| npm sbom --sbom-format=spdx --legacy-peer-deps --workspace ${dir} > "opentelemetry-js_${dir_name}.spdx.json" | |
| done | |
| - name: Generate SBOM for the API package | |
| if: startsWith(github.ref, 'refs/tags/api/') | |
| run: | | |
| npm sbom --sbom-format=spdx --legacy-peer-deps --workspace api > opentelemetry-js_api.spdx.json | |
| - name: Generate SBOMs for experimental packages | |
| if: startsWith(github.ref, 'refs/tags/experimental/') | |
| run: | | |
| for dir in $(find experimental/packages -mindepth 1 -maxdepth 1 -type d) | |
| do | |
| dir_name=$(basename "$dir") | |
| echo "Generating SBOM for $dir_name" | |
| npm sbom --sbom-format=spdx --legacy-peer-deps --workspace ${dir} > "opentelemetry-js_${dir_name}.spdx.json" | |
| done | |
| - name: Zip all SBOM files | |
| run: | | |
| zip sbom.zip *.spdx.json | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| archive: false | |
| path: ./sbom.zip | |
| add-release-artifact: | |
| needs: generate-sboms | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download artifact from generate-sboms | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: sbom.zip | |
| skip-decompress: true | |
| - name: Upload release asset | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| TAG: ${{ github.event.release.tag_name }} | |
| run: | | |
| mv sbom.zip SBOM.zip | |
| gh release upload "$TAG" ./SBOM.zip --clobber |