Skip to content
Snippets Groups Projects
Commit b61bdcdc authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

fix(sbom): only generate SBOMs on prod branches, integ branches and release tags

parent 13200fa3
No related branches found
No related tags found
No related merge requests found
...@@ -412,6 +412,7 @@ It is bound to the `test` stage, and uses the following variables: ...@@ -412,6 +412,7 @@ It is bound to the `test` stage, and uses the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| -------------------------------------- | ----------------------------------------------------------- | -------------------- | | -------------------------------------- | ----------------------------------------------------------- | -------------------- |
| `sbom-disabled` / `NODE_SBOM_DISABLED` | Set to `true` to disable this job | _none_ | | `sbom-disabled` / `NODE_SBOM_DISABLED` | Set to `true` to disable this job | _none_ |
| `TBC_SBOM_MODE` | Controls when SBOM reports are generated (`onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline).<br/>:warning: `sbom-disabled` / `NODE_SBOM_DISABLED` takes precedence | `onrelease` |
| `sbom-version` / `NODE_SBOM_VERSION` | The version of @cyclonedx/cyclonedx-npm used to emit SBOM | _none_ (uses latest) | | `sbom-version` / `NODE_SBOM_VERSION` | The version of @cyclonedx/cyclonedx-npm used to emit SBOM | _none_ (uses latest) |
| `sbom-opts` / `NODE_SBOM_OPTS` | Options for @cyclonedx/cyclonedx-npm used for SBOM analysis | `--omit dev` | | `sbom-opts` / `NODE_SBOM_OPTS` | Options for @cyclonedx/cyclonedx-npm used for SBOM analysis | `--omit dev` |
......
...@@ -154,6 +154,14 @@ ...@@ -154,6 +154,14 @@
"description": "This job generates a file listing all dependencies using [@cyclonedx/cyclonedx-npm](https://www.npmjs.com/package/@cyclonedx/cyclonedx-npm)", "description": "This job generates a file listing all dependencies using [@cyclonedx/cyclonedx-npm](https://www.npmjs.com/package/@cyclonedx/cyclonedx-npm)",
"disable_with": "NODE_SBOM_DISABLED", "disable_with": "NODE_SBOM_DISABLED",
"variables": [ "variables": [
{
"name": "TBC_SBOM_MODE",
"type": "enum",
"values": ["onrelease", "always"],
"description": "Controls when SBOM reports are generated (`onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline)",
"advanced": true,
"default": "onrelease"
},
{ {
"name": "NODE_SBOM_VERSION", "name": "NODE_SBOM_VERSION",
"description": "Version of the @cyclonedx/cyclonedx-npm used for SBOM analysis", "description": "Version of the @cyclonedx/cyclonedx-npm used for SBOM analysis",
......
...@@ -164,7 +164,18 @@ workflow: ...@@ -164,7 +164,18 @@ workflow:
# else (Ready MR): auto & failing # else (Ready MR): auto & failing
- when: on_success - when: on_success
# software delivery job prototype: run on production and integration branches + release pipelines
.delivery-policy:
rules:
# on tag with release pattern
- if: '$CI_COMMIT_TAG =~ $RELEASE_REF'
# on production or integration branch(es)
- if: '$CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF'
variables: variables:
# Global TBC SBOM Mode (onrelease -> only generate SBOMs for releases, always -> generate SBOMs for all refs)
TBC_SBOM_MODE: "onrelease"
# Default docker image for Node # Default docker image for Node
NODE_IMAGE: $[[ inputs.image ]] NODE_IMAGE: $[[ inputs.image ]]
# Default Node project root directory # Default Node project root directory
...@@ -835,7 +846,13 @@ node-sbom: ...@@ -835,7 +846,13 @@ node-sbom:
# exclude if disabled # exclude if disabled
- if: '$NODE_SBOM_DISABLED == "true"' - if: '$NODE_SBOM_DISABLED == "true"'
when: never when: never
- !reference [.test-policy, rules] # 'always' mode: run
- if: '$TBC_SBOM_MODE == "always"'
# exclude unsupported modes
- if: '$TBC_SBOM_MODE != "onrelease"'
when: never
# 'onrelease' mode: use common software delivery rules
- !reference [.delivery-policy, rules]
node-publish: node-publish:
extends: .node-base extends: .node-base
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment