Generate SBOM #208
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| branches: "*" | |
| push: | |
| branches: | |
| - "main" | |
| jobs: | |
| build-matrix: | |
| name: generate build matrix | |
| runs-on: | |
| - lab | |
| outputs: | |
| matrix: ${{ steps.matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: cargo-bins/cargo-binstall@main | |
| - name: install whyq | |
| run: | | |
| set -euxo pipefail | |
| sudo apt-get update | |
| sudo apt-get install --yes --no-install-recommends jq | |
| cargo binstall --no-confirm whyq | |
| - name: generate test matrix | |
| id: matrix | |
| run: | | |
| set -euxo pipefail | |
| yq \ | |
| --compact-output \ | |
| --raw-output \ | |
| '"matrix=" + (.matrix | tostring)' builds.yml \ | |
| | tee -a "${GITHUB_OUTPUT}" | |
| - name: report build plan | |
| run: | | |
| cat >> "${GITHUB_STEP_SUMMARY}" <<EOF | |
| # Action plan | |
| ## Build matrix | |
| \`\`\`yml | |
| $(yq --yaml-output '.matrix' builds.yml) | |
| \`\`\` | |
| ## Raw build flags file | |
| \`\`\`yml | |
| $(< ./nix/flags.nix) | |
| \`\`\` | |
| ## Build versions | |
| ### env | |
| \`\`\`yml | |
| $(yq --yaml-output '.env' builds.yml) | |
| \`\`\` | |
| <details> | |
| <summary> | |
| ## Raw \`builds.yml\` file | |
| </summary> | |
| \`\`\`yml | |
| $(< builds.yml) | |
| \`\`\` | |
| </details> | |
| <details> | |
| <summary> | |
| ## Raw \`versions.nix\` file | |
| </summary> | |
| \`\`\`nix | |
| $(< nix/versions.nix) | |
| \`\`\` | |
| </details> | |
| EOF | |
| build-and-push: | |
| name: build | |
| needs: build-matrix | |
| runs-on: | |
| - lab | |
| timeout-minutes: 300 | |
| strategy: | |
| matrix: ${{ fromJSON(needs.build-matrix.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: install nix | |
| uses: cachix/install-nix-action@v30 | |
| - name: confirm sources | |
| run: ./scripts/confirm-sources.sh | |
| - name: login to ghcr.io | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: "dtolnay/rust-toolchain@stable" | |
| - uses: "cargo-bins/cargo-binstall@main" | |
| - run: "cargo binstall --no-confirm just" | |
| - run: "cargo binstall --no-confirm csview" | |
| - run: | | |
| sudo apt-get update | |
| sudo apt-get install --yes --no-install-recommends graphviz | |
| - name: setup nix cache | |
| id: nix-package-cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: /nix | |
| key: /nixpkgs/${{ matrix.nixpkgs }} | |
| - name: build | |
| run: just --yes debug=true max_nix_builds=1 rust=${{matrix.toolchain.key}} build | |
| - name: Generate SBOM | |
| run: ./scripts/sbom.sh | |
| - name: push | |
| run: just --yes debug=true max_nix_builds=1 rust=${{matrix.toolchain.key}} push | |
| - name: garbage collect | |
| run: just --yes debug=true max_nix_builds=1 rust=${{matrix.toolchain.key}} nix-garbage-collector | |
| - name: clean up symlinks in /tmp/dpdk-sys/builds | |
| run: | | |
| for f in /tmp/dpdk-sys/builds/*; do | |
| [ -h "$f" ] && rm "$f" | |
| done | |
| - name: step summary | |
| run: | | |
| echo "# Outdated packages:" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.release.outdated.md >> $GITHUB_STEP_SUMMARY | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "# Runtime SBOM (gnu64):" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.release.runtime.sbom.md >> $GITHUB_STEP_SUMMARY | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "# Vuln scan (gnu64):" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.release.vulns.triage.md >> $GITHUB_STEP_SUMMARY | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: builds-${{ matrix.toolchain.key }} | |
| path: /tmp/dpdk-sys/builds | |
| # - name: Setup tmate session for debug | |
| # if: ${{ failure() }} | |
| # uses: mxschmitt/action-tmate@v3 | |
| # timeout-minutes: 30 | |
| # with: | |
| # limit-access-to-actor: true |