ci(publish): build, sign, pack, sbom generation and publish jobs #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Generate SBOM | |
| # Runs when the 'generate sbom' label is added to a PR, or when a release is published. | |
| # Uses the sbom-tool CLI (version pinned in .config/sbom-tool/dotnet-tools.json) | |
| # so the NuGet package is never modified and no SBOM is embedded in it. | |
| on: | |
| pull_request: | |
| types: [labeled] | |
| release: | |
| types: [published] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: sbom-${{ github.event_name == 'release' && github.ref_name || github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| env: | |
| BUILD_CONFIGURATION: Release | |
| PACKAGE_VERSION: ${{ github.event_name == 'release' && github.ref_name || format('0.0.0-pr.{0}', github.event.pull_request.number) }} | |
| jobs: | |
| sbom: | |
| if: github.event_name == 'release' || github.event.label.name == 'generate sbom' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: "10.0.x" | |
| - uses: actions/setup-node@v6.4.0 | |
| with: | |
| node-version: '22' | |
| - run: npm ci | |
| working-directory: src/IgniteUI.Blazor.GridLite | |
| - run: npm run build | |
| working-directory: src/IgniteUI.Blazor.GridLite | |
| - name: Pack NuGet package | |
| run: > | |
| dotnet pack src/IgniteUI.Blazor.GridLite/IgniteUI.Blazor.GridLite.csproj | |
| --configuration ${{ env.BUILD_CONFIGURATION }} | |
| -p:RunNodeBuild=false | |
| -p:GeneratePackageOnBuild=false | |
| -p:Version=${{ env.PACKAGE_VERSION }} | |
| -o ./artifacts | |
| # Dedicated nested manifest keeps sbom-tool out of the root 'dotnet tool restore' used by publish.yml | |
| - name: Restore sbom-tool (pinned) | |
| run: dotnet tool restore --tool-manifest .config/sbom-tool/dotnet-tools.json | |
| # -b: the shipped artifact (nupkg) gets listed with its hash in the SBOM's files section | |
| # -bc: dependency detection scans the project dir (NuGet + npm) | |
| - name: Generate SBOM | |
| working-directory: .config/sbom-tool | |
| run: > | |
| dotnet tool run sbom-tool -- generate | |
| -b ${{ github.workspace }}/artifacts | |
| -bc ${{ github.workspace }}/src/IgniteUI.Blazor.GridLite | |
| -pn IgniteUI.Blazor.GridLite | |
| -pv ${{ env.PACKAGE_VERSION }} | |
| -ps Infragistics | |
| -nsb http://spdx.org/spdxdocs/IgniteUI.Blazor.GridLite | |
| -V Information | |
| - name: Verify SBOM | |
| run: | | |
| set -euo pipefail | |
| test -s artifacts/_manifest/spdx_2.2/manifest.spdx.json | |
| test -s artifacts/_manifest/spdx_2.2/manifest.spdx.json.sha256 | |
| echo "SBOM generated successfully." | |
| - name: Upload NuGet package | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: nupkg | |
| path: artifacts/*.nupkg | |
| retention-days: 1 | |
| if-no-files-found: error | |
| - name: Upload SBOM files | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom-spdx_2.2 | |
| path: artifacts/_manifest/spdx_2.2 | |
| retention-days: 1 | |
| if-no-files-found: error | |
| attach-to-release: | |
| if: github.event_name == 'release' | |
| needs: sbom | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # required to upload release assets | |
| steps: | |
| - name: Download SBOM artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sbom-spdx_2.2 | |
| path: spdx_2.2 | |
| - name: Attach SBOM to release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| asset="IgniteUI.Blazor.GridLite.${TAG}.spdx_2.2.zip" | |
| (cd spdx_2.2 && zip -r "../${asset}" .) | |
| gh release upload "$TAG" "$asset" --clobber -R "${{ github.repository }}" |