Skip to content

[ci] Generate and upload a Software Bill of Materials #6645

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 14 commits into from
Feb 9, 2022
Merged

Conversation

pjcollins
Copy link
Member

@pjcollins pjcollins commented Jan 14, 2022

Context: https://eng.ms/docs/initiatives/executive-order/executive-order-requirements/executiveorderoncybersecurity/softwarebillofmaterials
Context: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/secure-supply-chain/ado-sbom-generator
Context: https://github.com/xamarin/yaml-templates/blob/4cabafec2cec4fc02b44635b196020cd00a60f03/compliance/sbom/job.v1.yml

A "post-build" stage has been added that will run after all "build" and
"prepare release" stages. This stage consists of one job which will
generate a Software Bill of Materials using shared yaml templates.
Other post processing jobs can be added to this stage in the future if
needed.

@pjcollins pjcollins requested a review from mjbond-msft January 18, 2022 18:26
@pjcollins
Copy link
Member Author

@mjbond-msft It looks like the latest changes generated a manifest: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=5638652&view=artifacts&pathAsName=false&type=publishedArtifacts.

The .json file only contains .vsix, .pkg, and .nupkg file information, and nothing about the contents of those packages. I'm not sure if all sub-components need to be included as well, but I think you have already raised this question? We can probably wait to land this until we have some more information about the artifacts that need to be captured.

@pjcollins pjcollins marked this pull request as ready for review February 7, 2022 18:13
@pjcollins pjcollins requested a review from jonpryor as a code owner February 7, 2022 18:13
@pjcollins pjcollins marked this pull request as draft February 8, 2022 19:52
@pjcollins
Copy link
Member Author

Going to use this to test out changes in https://github.com/xamarin/yaml-templates/pull/169 before merging.

@pjcollins pjcollins marked this pull request as ready for review February 9, 2022 16:43
@jonpryor jonpryor merged commit 9b19277 into main Feb 9, 2022
@jonpryor jonpryor deleted the sbom-job branch February 9, 2022 20:03
@github-actions github-actions bot locked and limited conversation to collaborators Jan 24, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants