Skip to content

Configure Renovate (#2) #4

Configure Renovate (#2)

Configure Renovate (#2) #4

Workflow file for this run

# Copyright 2024 Canonical Ltd.
# See LICENSE file for licensing details.
name: Release to GHCR
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
on:
push:
branches:
- 14-22.04
workflow_dispatch:
jobs:
build:
name: Build rock
uses: canonical/data-platform-workflows/.github/workflows/[email protected]
release:
name: Release rock
needs:
- build
uses: canonical/data-platform-workflows/.github/workflows/[email protected]
with:
artifact-prefix: ${{ needs.build.outputs.artifact-prefix }}
permissions:
packages: write # Needed to publish to GitHub Container Registry
sbom:
name: Generate Software Bill of Materials
needs:
- build
# Run after release so that rock cannot be (maliciously) modified between build & release
- release
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Install Syft
run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
- name: Download rock package(s)
uses: actions/download-artifact@v4
with:
pattern: ${{ needs.build.outputs.artifact-prefix }}-*
merge-multiple: true
- name: Generate SBOM(s)
shell: python
run: |
import pathlib
import subprocess
for rock_file in pathlib.Path(".").glob("*.rock"):
subprocess.run(
["syft", rock_file.name, "--output", f"spdx-json={rock_file.name}.spdx.json"],
check=True,
)
- name: Upload SBOM(s)
uses: actions/upload-artifact@v4
with:
name: sbom-${{ needs.build.outputs.artifact-prefix }}
path: '*.spdx.json'
if-no-files-found: error