SBOM Generation #1005
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SBOM Generation | |
| # Triggers and project version used in Dependency Track: | |
| # | |
| # Merge to develop → runs when dependency files change; version = commit SHA | |
| # Tag creation → runs on every tag; version = WIRE_SHORT_VERSION from xcconfig | |
| # Manual (workflow_dispatch): | |
| # use_commit_ref=true (default) → version = commit SHA of the checked-out ref | |
| # use_commit_ref=false → version = WIRE_SHORT_VERSION from xcconfig | |
| on: | |
| push: | |
| branches: | |
| - develop | |
| paths: | |
| - 'wire-ios-mono.xcworkspace/xcshareddata/swiftpm/Package.resolved' | |
| - 'Gemfile.lock' | |
| - 'Cartfile.resolved' | |
| - 'scripts/Package.swift' | |
| - 'WireAVS/Package.swift' | |
| - 'WireCoreCrypto/Package.swift' | |
| - 'wire-ios-build-assets/Gemfile.lock' | |
| create: | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: 'Branch or tag to check out' | |
| required: true | |
| default: 'develop' | |
| use_commit_ref: | |
| description: 'Use the commit SHA as the project version' | |
| type: boolean | |
| default: true | |
| jobs: | |
| sbom: | |
| # For the create event, only run on tag creation (not branch creation) | |
| if: github.event_name != 'create' || github.event.ref_type == 'tag' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2 | |
| with: | |
| ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }} | |
| token: ${{ secrets.SUBMODULE_PAT }} | |
| submodules: recursive | |
| - name: Read project version | |
| id: read_version | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| USE_COMMIT_REF: ${{ inputs.use_commit_ref }} | |
| run: | | |
| if [ "$EVENT_NAME" = "create" ] || { [ "$EVENT_NAME" = "workflow_dispatch" ] && [ "$USE_COMMIT_REF" != "true" ]; }; then | |
| VERSION=$(grep 'WIRE_SHORT_VERSION' wire-ios/Wire-iOS/Resources/Configuration/Version.xcconfig | cut -d'=' -f2 | tr -d ' ') | |
| echo "project_version=$VERSION" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "project_version=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Install Trivy | |
| run: | | |
| sudo apt-get install -y wget apt-transport-https gnupg | |
| wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add - | |
| echo "deb https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list | |
| sudo apt-get update && sudo apt-get install -y trivy | |
| - name: Generate SBOM | |
| run: python3 scripts/generate_sbom.py | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload SBOM artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: sbom-wire-ios-${{ steps.read_version.outputs.project_version }} | |
| path: bom.json | |
| retention-days: 90 | |
| - name: Upload SBOM to Dependency Track | |
| uses: DependencyTrack/gh-upload-sbom@48feab3080ff9e8f51f4d21861d9fc914eb744f5 #v3.1.0 | |
| with: | |
| serverhostname: ${{ secrets.DEPENDENCYTRACKURL }} | |
| apikey: ${{ secrets.DEPENDENCYTRACKKEY }} | |
| projectname: wire-ios | |
| projectversion: ${{ steps.read_version.outputs.project_version }} | |
| bomfilename: bom.json | |
| autocreate: true | |
| - name: Summary | |
| run: | | |
| echo "## SBOM Generation" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| | |" >> $GITHUB_STEP_SUMMARY | |
| echo "|---|---|" >> $GITHUB_STEP_SUMMARY | |
| echo "| **Project** | wire-ios |" >> $GITHUB_STEP_SUMMARY | |
| echo "| **Version** | ${{ steps.read_version.outputs.project_version }} |" >> $GITHUB_STEP_SUMMARY |