-
Notifications
You must be signed in to change notification settings - Fork 553
[ci] Generate and upload a Software Bill of Materials #6645
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
@mjbond-msft It looks like the latest changes generated a manifest: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=5638652&view=artifacts&pathAsName=false&type=publishedArtifacts. The .json file only contains .vsix, .pkg, and .nupkg file information, and nothing about the contents of those packages. I'm not sure if all sub-components need to be included as well, but I think you have already raised this question? We can probably wait to land this until we have some more information about the artifacts that need to be captured. |
Conflicts: build-tools/automation/azure-pipelines.yaml
Going to use this to test out changes in https://github.com/xamarin/yaml-templates/pull/169 before merging. |
Context: https://eng.ms/docs/initiatives/executive-order/executive-order-requirements/executiveorderoncybersecurity/softwarebillofmaterials
Context: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/secure-supply-chain/ado-sbom-generator
Context: https://github.com/xamarin/yaml-templates/blob/4cabafec2cec4fc02b44635b196020cd00a60f03/compliance/sbom/job.v1.yml
A "post-build" stage has been added that will run after all "build" and
"prepare release" stages. This stage consists of one job which will
generate a Software Bill of Materials using shared yaml templates.
Other post processing jobs can be added to this stage in the future if
needed.