Update SBOM schema #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update SBOM schema | |
| on: | |
| push: | |
| paths: | |
| - .github/workflows/sbom.yml | |
| branches-ignore: | |
| - main | |
| - master | |
| schedule: | |
| - cron: "0 0 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash -xeuo pipefail {0} | |
| jobs: | |
| sbom: | |
| if: github.repository == 'Homebrew/brew' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Set up Homebrew | |
| id: set-up-homebrew | |
| uses: Homebrew/actions/setup-homebrew@main | |
| with: | |
| core: false | |
| cask: false | |
| - name: Configure Git user | |
| uses: Homebrew/actions/git-user-config@main | |
| with: | |
| username: BrewTestBot | |
| - name: Set up commit signing | |
| uses: Homebrew/actions/setup-commit-signing@main | |
| with: | |
| signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }} | |
| - name: Update schema data | |
| id: update | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }} | |
| working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }} | |
| run: | | |
| git fetch origin | |
| BRANCH="schema-update" | |
| echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT" | |
| if git ls-remote --exit-code --heads origin "${BRANCH}" | |
| then | |
| git checkout "${BRANCH}" | |
| git checkout "Library/Homebrew/data/schemas" | |
| else | |
| git checkout --no-track -B "${BRANCH}" origin/HEAD | |
| fi | |
| # Intentionally tracking 2.3.x to match what we output in sbom.rb. 3.0 also doesn't have a JSON Schema. | |
| # Note: this is a 2.3.1 development branch - not a 2.3.1 tag. It contains bugfixes compared to 2.3.0. | |
| curl --location --output Library/Homebrew/data/schemas/sbom.json https://raw.githubusercontent.com/spdx/spdx-spec/support/v2.3.1/schemas/spdx-schema.json | |
| # https://github.com/spdx/spdx-spec/pull/1029 | |
| sed -i -e 's|\(2019-09/schema\)#|\1|' Library/Homebrew/data/schemas/sbom.json | |
| if ! git diff --exit-code Library/Homebrew/data/schemas | |
| then | |
| git add "Library/Homebrew/data/schemas" | |
| git commit -m "data/schemas: update schema data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/sbom.yml)." | |
| echo "committed=true" >> "$GITHUB_OUTPUT" | |
| PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state" || true)" | |
| if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]] | |
| then | |
| echo "pull_request=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| - name: Push commits | |
| if: steps.update.outputs.committed == 'true' | |
| uses: Homebrew/actions/git-try-push@main | |
| with: | |
| token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }} | |
| directory: ${{ steps.set-up-homebrew.outputs.repository-path }} | |
| branch: ${{ steps.update.outputs.branch }} | |
| force: true | |
| origin_branch: "HEAD" | |
| - name: Open a pull request | |
| if: steps.update.outputs.pull_request == 'true' | |
| run: gh pr create --fill | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }} | |
| working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }} | |
| issue: | |
| needs: sbom | |
| if: always() && github.event_name == 'schedule' | |
| runs-on: ubuntu-latest | |
| env: | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| permissions: | |
| # To create or update issues | |
| issues: write | |
| steps: | |
| - name: Open, update, or close schema issue | |
| uses: Homebrew/actions/create-or-update-issue@main | |
| with: | |
| title: Failed to update SBOM schema | |
| body: > | |
| The SBOM schema workflow [failed](${{ env.RUN_URL }}). No SBOM schema was updated. | |
| labels: bug | |
| update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }} | |
| close-existing: ${{ needs.sbom.result == 'success' }} | |
| close-from-author: github-actions[bot] | |
| close-comment: > | |
| The SBOM schema workflow [succeeded](${{ env.RUN_URL }}). Closing this issue. |