fix: capture re-usable workflows as actions instead of scripts #1374
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| --- | ||
| name: Generate tool inventory | ||
| description: >- | ||
| Derive a curated, per-flavor tool inventory from a Syft SPDX SBOM and write it | ||
| to a JSON file. | ||
|
|
||
| inputs: | ||
| sbom: | ||
| description: Path to the Syft SPDX SBOM | ||
| required: true | ||
| allowlist: | ||
| description: >- | ||
| Path to the flavor's tool allowlist JSON, relative to the caller | ||
| repository root. The file is sparse-checked-out by this action. | ||
| required: true | ||
| flavor: | ||
| description: Name of the flavor the inventory is generated for | ||
| required: true | ||
| output-file: | ||
| description: Path the generated tool inventory is written to | ||
| required: false | ||
| default: tool-inventory.json | ||
|
|
||
| outputs: | ||
| inventory-file: | ||
| description: Path to the generated tool inventory JSON file | ||
| value: ${{ inputs.output-file }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| # The allowlist lives in the caller repository; check out just that file so | ||
| # the action is self-contained and callers need no separate checkout step. | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| persist-credentials: false | ||
| sparse-checkout: ${{ inputs.allowlist }} | ||
| sparse-checkout-cone-mode: false | ||
| - shell: bash | ||
|
rjaegers marked this conversation as resolved.
|
||
| run: | | ||
| set -Eeuo pipefail | ||
|
|
||
| # Keep only packages whose name is on the flavor allowlist and project them | ||
| # to {name, version, purl}. Versions come straight from the SBOM, so the | ||
| # inventory can never disagree with it. | ||
| inventory="$(jq -n \ | ||
| --slurpfile sbom "${SBOM}" \ | ||
| --slurpfile allow "${ALLOWLIST}" \ | ||
| --arg flavor "${FLAVOR}" ' | ||
| ($allow[0] | map(ascii_downcase)) as $names | ||
| | [ $sbom[0].packages[] | ||
| | select(.name != null) | ||
| | . as $pkg | ||
| | select($names | index($pkg.name | ascii_downcase)) | ||
| | { name: $pkg.name, | ||
| version: $pkg.versionInfo, | ||
| purl: ([ $pkg.externalRefs[]? | select(.referenceType == "purl") | .referenceLocator ] | first) } ] | ||
| | unique_by(.name | ascii_downcase) | ||
| | sort_by(.name | ascii_downcase) | ||
| | { flavor: $flavor, tools: . }')" | ||
|
|
||
| # Fail if an allowlisted tool is absent from the SBOM. This turns a version | ||
| # bump that renames a package (e.g. clang-22 -> clang-23) or a tool that | ||
| # silently dropped out of the image into a hard, actionable CI error. | ||
| missing="$(jq -rn \ | ||
| --argjson inventory "${inventory}" \ | ||
| --slurpfile allow "${ALLOWLIST}" ' | ||
| ($inventory.tools | map(.name | ascii_downcase)) as $found | ||
| | $allow[0] | ||
| | map(select((ascii_downcase) as $name | ($found | index($name)) | not)) | ||
| | .[]')" | ||
|
|
||
| if [ -n "${missing}" ]; then | ||
| echo "error: the following allowlisted tools were not found in the SBOM:" >&2 | ||
| echo "${missing}" | sed 's/^/ - /' >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "${inventory}" | tee "${OUTPUT_FILE}" | ||
| env: | ||
| SBOM: ${{ inputs.sbom }} | ||
| ALLOWLIST: ${{ inputs.allowlist }} | ||
| FLAVOR: ${{ inputs.flavor }} | ||
| OUTPUT_FILE: ${{ inputs.output-file }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| --- | ||
| name: Merge devcontainer.metadata | ||
| description: >- | ||
| Assemble the devcontainer.metadata image label for a flavor by concatenating | ||
| the base image's existing metadata array with the flavor's own metadata entry. | ||
|
|
||
| inputs: | ||
| base-image: | ||
| description: Reference of the image this flavor is built FROM (may be empty) | ||
| required: false | ||
| default: "" | ||
| devcontainer-metadata-file: | ||
| description: Path to the flavor's devcontainer-metadata.json (may be absent) | ||
| required: false | ||
| default: "" | ||
|
|
||
| outputs: | ||
| label: | ||
| description: >- | ||
| The `devcontainer.metadata=<json-array>` label value, or empty when no | ||
| metadata file is provided. | ||
| value: ${{ steps.merge.outputs.label }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - id: merge | ||
| shell: bash | ||
| run: | | ||
| set -Eeuo pipefail | ||
|
|
||
| if [ -z "${DEVCONTAINER_METADATA_FILE:-}" ] || [ ! -f "${DEVCONTAINER_METADATA_FILE}" ]; then | ||
| echo "devcontainer-metadata-file input not set or file does not exist, skipping devcontainer.metadata label" | ||
| echo "label=" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # Extract the base image's existing devcontainer.metadata array. Falls back | ||
| # to an empty array when no base image is given or it carries no such label. | ||
| base_metadata="[]" | ||
| if [ -n "${BASE_IMAGE:-}" ]; then | ||
| # `.Image` is the image config for single-platform references and a map of | ||
| # `platform -> config` for multi-platform references; the label is identical | ||
| # across platforms, so any entry works. | ||
| config="$(docker buildx imagetools inspect "${BASE_IMAGE}" --format '{{json .Image}}')" | ||
| base_metadata="$(jq -c ' | ||
| (if has("config") then . else (to_entries[0].value) end) | ||
| | (.config.Labels["devcontainer.metadata"] // "") as $raw | ||
| | if $raw == "" then [] else (try ($raw | fromjson) catch []) end | ||
| | if type == "array" then . else [] end | ||
| ' <<< "${config}")" | ||
| fi | ||
|
|
||
| # Concatenate base entries with the flavor entry and emit the label value. | ||
| # The gsub adds a space after each comma so `docker buildx build --label` | ||
| # does not misinterpret the array and produce invalid JSON (e.g. | ||
| # ["x","y"] -> ["x",y]). | ||
| merged="$(jq -cr --slurpfile flavor "${DEVCONTAINER_METADATA_FILE}" '. + $flavor | @json | gsub("\",\""; "\", \"")' <<< "${base_metadata}")" | ||
|
|
||
| echo "label=devcontainer.metadata=${merged}" >> "$GITHUB_OUTPUT" | ||
| env: | ||
| BASE_IMAGE: ${{ inputs.base-image }} | ||
| DEVCONTAINER_METADATA_FILE: ${{ inputs.devcontainer-metadata-file }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.