quine-global-labs/aurora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ci): re-enable SBOM generation (#1548)

Browse source 
* feat(ci): re-enable SBOM generation

Other methods of generating it causes the runner to run out of memory.

* fix: don't run in PRs

* Update .github/workflows/reusable-build.yml

Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>

* Update .github/workflows/reusable-build.yml

Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>

---------

Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
This commit is contained in:
renner 2026-01-01 05:04:47 +01:00 committed by GitHub
parent 1c3ab0877a
commit 19f35e7944
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
.github/workflows/reusable-build.yml vendored
View file

@ -104,25 +104,31 @@ jobs:
- name: Setup Syft
id: setup-syft
if: false
if: github.event_name != 'pull_request'
uses: anchore/sbom-action/download-syft@a930d0ac434e3182448fe678398ba5713717112a # v0
with:
syft-version: v1.20.0
syft-version: v1.39.0
- name: Generate SBOM
if: false
if: github.event_name != 'pull_request'
id: generate-sbom
env:
IMAGE: ${{ env.IMAGE_NAME }}
STREAM_NAME: ${{ matrix.stream_name }}
SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
OCI_DIR: "/tmp/image-oci-dir"
run: |
sudo systemctl start podman.socket
mkdir -p ${OCI_DIR}/rootfs
sudo podman container create --replace --name aurora-tmp "localhost/${IMAGE}:${STREAM_NAME}"
sudo podman export aurora-tmp | sudo tar -C ${OCI_DIR}/rootfs -xf -
sudo podman container rm aurora-tmp
OUTPUT_PATH="$(mktemp -d)/sbom.json"
export SYFT_PARALLELISM=$(($(nproc)*2))
sudo $SYFT_CMD ${IMAGE}:${STREAM_NAME} -o spdx-json=${OUTPUT_PATH}
sudo $SYFT_CMD --source-name "${IMAGE}"-"${STREAM_NAME}" --select-catalogers=rpm ${OCI_DIR} -o spdx-json=${OUTPUT_PATH}
ls -lh ${OUTPUT_PATH}
echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT
sudo rm -rf ${OCI_DIR}
- name: Rechunk Image
id: rechunk-image
@ -255,7 +261,7 @@ jobs:
IMAGE_NAME: ${{ env.IMAGE_NAME }}
- name: Add SBOM Attestation
if: false
if: github.event_name != 'pull_request'
env:
IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
DIGEST: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}