From 261e8ceb2d360768de0cc8fe3326cc9dfea4c121 Mon Sep 17 00:00:00 2001
From: Pierre Smeyers <pierre.smeyers@gmail.com>
Date: Fri, 31 Jan 2025 07:52:51 +0100
Subject: [PATCH] fix(sbom): only generate SBOMs on prod branches, integ
branches and release tags
---
README.md | 1 +
kicker.json | 8 ++++++++
templates/gitlab-ci-golang.yml | 21 ++++++++++++++++++++-
3 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
index e4faef8..09d6692 100644
--- a/README.md
+++ b/README.md
@@ -256,6 +256,7 @@ It is bound to the `test` stage, and uses the following variables:
| Input / Variable | Description | Default value |
| --------------------- | -------------------------------------- | ----------------- |
| `sbom-disabled` / `GO_SBOM_DISABLED` | Set to `true` to disable this job | _none_ |
+| `TBC_SBOM_MODE` | Controls when SBOM reports are generated (`onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline).<br/>:warning: `sbom-disabled` / `GO_SBOM_DISABLED` takes precedence | `onrelease` |
| `sbom-image` / `GO_SBOM_IMAGE` | Image of cyclonedx-gomod used for SBOM analysis | `registry.hub.docker.com/cyclonedx/cyclonedx-gomod:latest` |
| `sbom-opts` / `GO_SBOM_OPTS` | [@cyclonedx/cyclonedx-gomod options](https://github.com/CycloneDX/cyclonedx-gomod#usage) used for SBOM analysis | `-main .` |
diff --git a/kicker.json b/kicker.json
index df960da..f709fcf 100644
--- a/kicker.json
+++ b/kicker.json
@@ -140,6 +140,14 @@
"description": "This job generates a file listing all dependencies using [cyclonedx-gomod](https://github.com/CycloneDX/cyclonedx-gomod)",
"disable_with": "GO_SBOM_DISABLED",
"variables": [
+ {
+ "name": "TBC_SBOM_MODE",
+ "type": "enum",
+ "values": ["onrelease", "always"],
+ "description": "Controls when SBOM reports are generated (`onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline)",
+ "advanced": true,
+ "default": "onrelease"
+ },
{
"name": "GO_SBOM_IMAGE",
"default": "registry.hub.docker.com/cyclonedx/cyclonedx-gomod:latest"
diff --git a/templates/gitlab-ci-golang.yml b/templates/gitlab-ci-golang.yml
index 07fe9f7..335998c 100644
--- a/templates/gitlab-ci-golang.yml
+++ b/templates/gitlab-ci-golang.yml
@@ -164,7 +164,18 @@ workflow:
# else (Ready MR): auto & failing
- when: on_success
+# software delivery job prototype: run on production and integration branches + release pipelines
+.delivery-policy:
+ rules:
+ # on tag with release pattern
+ - if: '$CI_COMMIT_TAG =~ $RELEASE_REF'
+ # on production or integration branch(es)
+ - if: '$CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF'
+
variables:
+ # Global TBC SBOM Mode (onrelease -> only generate SBOMs for releases, always -> generate SBOMs for all refs)
+ TBC_SBOM_MODE: "onrelease"
+
# Default Go project root directory
GO_PROJECT_DIR: $[[ inputs.project-dir ]]
@@ -228,6 +239,8 @@ variables:
PROD_REF: /^(master|main)$/
# default integration ref name (pattern)
INTEG_REF: /^develop$/
+ # default release tag name (pattern)
+ RELEASE_REF: '/^v?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9-\.]+)?(\+[a-zA-Z0-9-\.]+)?$/'
stages:
- build
@@ -815,7 +828,13 @@ go-sbom:
# exclude if disabled
- if: '$GO_SBOM_DISABLED == "true"'
when: never
- - !reference [.test-policy, rules]
+ # 'always' mode: run
+ - if: '$TBC_SBOM_MODE == "always"'
+ # exclude unsupported modes
+ - if: '$TBC_SBOM_MODE != "onrelease"'
+ when: never
+ # 'onrelease' mode: use common software delivery rules
+ - !reference [.delivery-policy, rules]
go-govulncheck:
extends: .go-base
--
GitLab