Skip to content

Commit c05c1af

Browse files
m4nch0tm4nch0t
authored
Merge pull request #23 from scality/bump-versions
Bump versions and add update version workflow
2 parents 1fe12bd + 5fe061a commit c05c1af

File tree

4 files changed

+119
-18
lines changed

4 files changed

+119
-18
lines changed

‎.github/scripts/update_tools.py‎

Lines changed: 60 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
from pathlib import Path
1010
import yaml
1111
import requests
12+
import re
1213

1314
# Add the root directory to the Python path
1415
ROOT_DIR = Path(__file__).resolve().parents[2]
@@ -35,6 +36,54 @@ def get_latest_release(package_name, package_info):
3536
print(f"⚠ Error fetching latest version for {package_name}: {str(error)}")
3637
return None
3738

39+
def update_readme(packages):
40+
"""Update version references in README.md file."""
41+
readme_file = ROOT_DIR / "README.md"
42+
if not readme_file.exists():
43+
print("⚠ README.md not found, skipping README updates")
44+
return False
45+
46+
readme_content = readme_file.read_text(encoding="utf-8")
47+
updated_content = readme_content
48+
readme_updates_made = False
49+
50+
# Update version references in the README
51+
version_mappings = {
52+
"grype": packages.get("grype", {}).get("default_version", ""),
53+
"syft": packages.get("syft", {}).get("default_version", "")
54+
}
55+
56+
for tool, version in version_mappings.items():
57+
if not version:
58+
continue
59+
60+
# Update default version in parameter table
61+
old_pattern = f"| `{tool}-version` | {tool.title()} version to use | `"
62+
if old_pattern in updated_content:
63+
# Find the current version in the table
64+
import re
65+
pattern = rf"(\| `{tool}-version`\s+\| {tool.title()} version to use\s+\| `)([^`]+)(`\s+\|)"
66+
match = re.search(pattern, updated_content)
67+
if match and match.group(2) != version:
68+
updated_content = re.sub(pattern, rf"\g<1>{version}\g<3>", updated_content)
69+
print(f"⬆ Updated {tool}-version in README table from {match.group(2)} to {version}")
70+
readme_updates_made = True
71+
72+
# Update version in CycloneDX metadata example (specifically for syft)
73+
if tool == "syft":
74+
syft_version_pattern = r'("name": "syft",\s+"version": ")([^"]+)(")'
75+
match = re.search(syft_version_pattern, updated_content)
76+
if match and match.group(2) != version:
77+
updated_content = re.sub(syft_version_pattern, rf"\g<1>{version}\g<3>", updated_content)
78+
print(f"⬆ Updated syft version in README example from {match.group(2)} to {version}")
79+
readme_updates_made = True
80+
81+
if readme_updates_made:
82+
readme_file.write_text(updated_content, encoding="utf-8")
83+
print("✓ README.md updates applied")
84+
85+
return readme_updates_made
86+
3887
def update_versions():
3988
"""Update the tools versions in the versions file while preserving format."""
4089
updates_made = False
@@ -54,16 +103,20 @@ def update_versions():
54103
else:
55104
print(f"✓ {package_name} is already at latest version {latest_version}")
56105

57-
if not updates_made:
106+
# Update README regardless of whether versions.yaml was updated
107+
readme_updated = update_readme(packages)
108+
109+
if not updates_made and not readme_updated:
58110
print("✓ All tools are already at their latest versions. No updates needed.")
59111
return
60112

61-
# Write the updated data back to the file using the constant VERSION_FILE
62-
VERSION_FILE.write_text(
63-
yaml.dump(data, default_flow_style=False, sort_keys=False),
64-
encoding="utf8"
65-
)
66-
print("✓ Updates applied to", VERSION_FILE)
113+
if updates_made:
114+
# Write the updated data back to the file using the constant VERSION_FILE
115+
VERSION_FILE.write_text(
116+
yaml.dump(data, default_flow_style=False, sort_keys=False),
117+
encoding="utf8"
118+
)
119+
print("✓ Updates applied to", VERSION_FILE)
67120

68121
if __name__ == "__main__":
69122
update_versions()

‎.github/workflows/update.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Update Tool Versions
2+
on:
3+
schedule:
4+
- cron: "23 0 * * *" # Runs daily at 23:00 UTC
5+
workflow_dispatch:
6+
7+
jobs:
8+
update-versions:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4
13+
with:
14+
token: ${{ secrets.GITHUB_TOKEN }}
15+
16+
- name: Configure Git
17+
run: |
18+
git config --local user.email "[email protected]"
19+
git config --local user.name "GitHub Action"
20+
21+
- name: Set up Python
22+
uses: actions/setup-python@v5
23+
with:
24+
python-version: '3.x'
25+
26+
- name: Install dependencies
27+
run: pip install -r requirements.txt
28+
29+
- name: Update tool versions
30+
run: python .github/scripts/update_tools.py
31+
32+
- name: Create Pull Request
33+
uses: peter-evans/create-pull-request@v7
34+
with:
35+
token: ${{ secrets.GITHUB_TOKEN }}
36+
commit-message: ':arrow_up: update tool versions'
37+
title: 'Update scanner tool versions'
38+
body: |
39+
Automated version bump of scanner versions.
40+
41+
**Changes:**
42+
- Update version in README.md
43+
- Update version in versions.yaml
44+
45+
**Next steps:**
46+
1. Review and merge this PR
47+
2. Create a release tag: `v${{ github.event.inputs.version }}-${{ github.event.inputs.collection }}`
48+
branch: update-tool-versions

‎README.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ The main [SBOM action](action.yaml) is responsible for generating SBOMs.
2424

2525
| Parameter | Description | Default |
2626
| -------------------- | ------------------------------------------------------------------------------------------- | ------------ |
27-
| `grype-version` | Grype version to use | `0.91.0` |
28-
| `syft-version` | Syft version to use | `1.22.0` |
29-
| `target` | The target to scan (path or image) | `./` |
30-
| `target-type` | Type of target to scan (file, directory, image, iso) | `file` |
31-
| `output-format` | Format of the generated SBOM (cyclonedx-json cyclonedx-xml github-json spdx-json spdx-tag-value syft-json syft-table syft-text template) | `cyclonedx-json` |
27+
| `grype-version` | Grype version to use | `0.96.1` |
28+
| `syft-version` | Syft version to use | `1.29.0` |
29+
| `target` | The target to scan (path or image) | `./` |
30+
| `target-type` | Type of target to scan (file, directory, image, iso) | `file` |
31+
| `output-format` | Format of the generated SBOM <br> (cyclonedx-json cyclonedx-xml github-json spdx-json spdx-tag-value syft-json syft-table syft-text template) | `cyclonedx-json` |
3232
| `output-file` | A specific file location to store the SBOM | |
3333
| `output-dir` | Directory to store generated SBOM files | `/tmp/sbom` |
3434
| `exclude-mediatypes` | Media types to exclude for images (comma-separated) | |
@@ -38,7 +38,7 @@ The main [SBOM action](action.yaml) is responsible for generating SBOMs.
3838
| `merge` | Merge multiple SBOMs into a single file | `false` |
3939
| `merge_hierarchical` | Merge multiple SBOMs into a single hierarchical file | `false` |
4040
| `vuln` | Enable vulnerability scanning | `false` |
41-
| `vuln-output-format` | Format for the vulnerability report when `vuln` is enabled (supports `json`, `html`, `csv`, `table`, or comma-separated values like `html,json`) | `cyclonedx-json` |
41+
| `vuln-output-format` | Format for the vulnerability report when `vuln` is enabled<br>(supports `json`, `html`, `csv`, `table`, or comma-separated values like `html,json`) | `cyclonedx-json`|
4242
| `vuln-output-file` | A specific file location to store the vulnerability report | |
4343

4444
## Example Usage
@@ -185,7 +185,7 @@ In the generated SBOM files, you will find CycloneDX metadata. Examples include:
185185
"type": "application",
186186
"author": "anchore",
187187
"name": "syft",
188-
"version": "1.21.0"
188+
"version": "1.29.0"
189189
}
190190
]
191191
},
@@ -216,7 +216,7 @@ In the generated SBOM files, you will find CycloneDX metadata. Examples include:
216216
"type": "application",
217217
"author": "anchore",
218218
"name": "syft",
219-
"version": "1.21.0"
219+
"version": "1.29.0"
220220
}
221221
]
222222
},

‎versions.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
packages:
22
syft:
3-
default_version: 1.22.0
3+
default_version: 1.29.0
44
editor: anchore
55
artifact: '{package_name}_{version}_linux_amd64.tar.gz'
66
binary: syft
77
checksums: true
88
grype:
9-
default_version: 0.91.0
9+
default_version: 0.96.1
1010
editor: anchore
1111
artifact: '{package_name}_{version}_linux_amd64.tar.gz'
1212
binary: grype
1313
checksums: true
1414
cyclonedx-cli:
15-
default_version: 0.27.2
15+
default_version: 0.29.0
1616
editor: CycloneDX
1717
artifact: cyclonedx-linux-x64
1818
binary: cyclonedx-linux-x64

0 commit comments

Comments
 (0)