Skip to content

Commit c2fc7b1

Browse files
sns45sns45
authored
Dogfood Go/Rust/Gradle ecosystems in CI (#23)
Adds minimal example projects with real lockfiles for the three new ecosystems and runs the full forgeseal pipeline against each in CI: - examples/go-app: chi/uuid/testify with real go.mod + go.sum - examples/rust-app: serde/serde_json generated via cargo generate-lockfile - examples/gradle-app: representative gradle.lockfile with production + test-only deps and matching build.gradle CI now runs the SBOM + VEX triage pipeline against hono-app, go-app, rust-app, and gradle-app and verifies each produces both artifacts. Closes #22
1 parent 4980150 commit c2fc7b1

12 files changed

Lines changed: 280 additions & 5 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 34 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,47 @@ jobs:
2222
- name: Test
2323
run: make test
2424

25-
# End-to-end: run full pipeline against reference project
25+
# End-to-end: run full pipeline against reference projects
2626
- name: E2E pipeline (examples/hono-app)
2727
run: |
2828
./bin/forgeseal pipeline \
2929
--dir ./examples/hono-app \
30-
--output-dir ./e2e-output \
30+
--output-dir ./e2e-output/hono-app \
31+
--sign=false \
32+
--attest=false \
33+
--vex-triage
34+
35+
- name: E2E pipeline (examples/go-app)
36+
run: |
37+
./bin/forgeseal pipeline \
38+
--dir ./examples/go-app \
39+
--output-dir ./e2e-output/go-app \
40+
--sign=false \
41+
--attest=false \
42+
--vex-triage
43+
44+
- name: E2E pipeline (examples/rust-app)
45+
run: |
46+
./bin/forgeseal pipeline \
47+
--dir ./examples/rust-app \
48+
--output-dir ./e2e-output/rust-app \
49+
--sign=false \
50+
--attest=false \
51+
--vex-triage
52+
53+
- name: E2E pipeline (examples/gradle-app)
54+
run: |
55+
./bin/forgeseal pipeline \
56+
--dir ./examples/gradle-app \
57+
--output-dir ./e2e-output/gradle-app \
3158
--sign=false \
3259
--attest=false \
3360
--vex-triage
3461
3562
- name: Verify E2E output
3663
run: |
37-
test -f ./e2e-output/sbom.cdx.json || (echo "SBOM not generated" && exit 1)
38-
test -f ./e2e-output/vex.json || (echo "VEX not generated" && exit 1)
39-
echo "E2E pipeline passed"
64+
for app in hono-app go-app rust-app gradle-app; do
65+
test -f "./e2e-output/$app/sbom.cdx.json" || (echo "SBOM not generated for $app" && exit 1)
66+
test -f "./e2e-output/$app/vex.json" || (echo "VEX not generated for $app" && exit 1)
67+
done
68+
echo "E2E pipelines passed for all example apps"

‎examples/go-app/go.mod‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
module example.com/go-app
2+
3+
go 1.23
4+
5+
require (
6+
github.com/go-chi/chi/v5 v5.2.5
7+
github.com/google/uuid v1.6.0
8+
github.com/stretchr/testify v1.11.1
9+
)
10+
11+
require (
12+
github.com/davecgh/go-spew v1.1.1 // indirect
13+
github.com/pmezard/go-difflib v1.0.0 // indirect
14+
gopkg.in/yaml.v3 v3.0.1 // indirect
15+
)

‎examples/go-app/go.sum‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
2+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
3+
github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
4+
github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
5+
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
6+
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
7+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
8+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
9+
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
10+
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
11+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
12+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
13+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
14+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎examples/go-app/main.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Package main is a minimal Go HTTP service used as a forgeseal dogfood fixture.
2+
package main
3+
4+
import (
5+
"log"
6+
"net/http"
7+
8+
"github.com/go-chi/chi/v5"
9+
"github.com/go-chi/chi/v5/middleware"
10+
"github.com/google/uuid"
11+
)
12+
13+
func main() {
14+
r := chi.NewRouter()
15+
r.Use(middleware.Logger)
16+
r.Get("/", func(w http.ResponseWriter, _ *http.Request) {
17+
_, _ = w.Write([]byte("hello from go-app " + uuid.NewString()))
18+
})
19+
log.Fatal(http.ListenAndServe(":8080", r))
20+
}

‎examples/go-app/main_test.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package main
2+
3+
import (
4+
"testing"
5+
6+
"github.com/stretchr/testify/assert"
7+
)
8+
9+
func TestSanity(t *testing.T) {
10+
assert.Equal(t, 2, 1+1)
11+
}

‎examples/gradle-app/build.gradle‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
plugins {
2+
id 'java'
3+
id 'application'
4+
}
5+
6+
group = 'com.example'
7+
version = '0.1.0'
8+
9+
repositories {
10+
mavenCentral()
11+
}
12+
13+
dependencyLocking {
14+
lockAllConfigurations()
15+
}
16+
17+
dependencies {
18+
implementation 'com.google.guava:guava:33.2.1-jre'
19+
implementation 'com.fasterxml.jackson.core:jackson-databind:2.17.1'
20+
implementation 'org.apache.commons:commons-lang3:3.14.0'
21+
runtimeOnly 'ch.qos.logback:logback-classic:1.5.6'
22+
testImplementation 'org.junit.jupiter:junit-jupiter-api:5.10.2'
23+
testImplementation 'org.mockito:mockito-core:5.12.0'
24+
testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.10.2'
25+
}
26+
27+
application {
28+
mainClass = 'com.example.App'
29+
}

‎examples/gradle-app/gradle.lockfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# This is a Gradle generated file for dependency locking.
2+
# Manual edits can break the build and are not advised.
3+
# This file is expected to be part of source control.
4+
ch.qos.logback:logback-classic:1.5.6=runtimeClasspath,testRuntimeClasspath
5+
ch.qos.logback:logback-core:1.5.6=runtimeClasspath,testRuntimeClasspath
6+
com.fasterxml.jackson.core:jackson-annotations:2.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
7+
com.fasterxml.jackson.core:jackson-core:2.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
8+
com.fasterxml.jackson.core:jackson-databind:2.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
9+
com.google.guava:guava:33.2.1-jre=compileClasspath,runtimeClasspath
10+
org.apache.commons:commons-lang3:3.14.0=compileClasspath,runtimeClasspath
11+
org.slf4j:slf4j-api:2.0.13=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
12+
org.junit.jupiter:junit-jupiter-api:5.10.2=testCompileClasspath,testRuntimeClasspath
13+
org.junit.jupiter:junit-jupiter-engine:5.10.2=testRuntimeClasspath
14+
org.junit.platform:junit-platform-commons:1.10.2=testCompileClasspath,testRuntimeClasspath
15+
org.junit.platform:junit-platform-engine:1.10.2=testRuntimeClasspath
16+
org.mockito:mockito-core:5.12.0=testCompileClasspath,testRuntimeClasspath
17+
org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testRuntimeClasspath
18+
org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
19+
empty=annotationProcessor,testAnnotationProcessor

‎examples/gradle-app/settings.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
rootProject.name = 'gradle-app'

‎examples/gradle-app/src/main/java/com/example/App.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
package com.example;
2+
3+
import com.google.common.base.Strings;
4+
5+
public class App {
6+
public static void main(String[] args) {
7+
System.out.println(Strings.repeat("hello from gradle-app ", 1));
8+
}
9+
}

‎examples/rust-app/Cargo.lock‎

Lines changed: 107 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)