Commit 8d14d9df authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

fix(sbom): only generate SBOMs on prod branches, integ branches and release tags

parent 3a86eee3

README.md

+1 −0
Original line number Diff line number Diff line
@@ -269,6 +269,7 @@ It is bound to the `test` stage, and uses the following variables: 
| Input / Variable | Description                            | Default value     |

| --------------------- | -------------------------------------- | ----------------- |

| `sbom-disabled` / `GRADLE_SBOM_DISABLED` | Set to `true` to disable this job | _none_ |

| `TBC_SBOM_MODE`                          | Controls when SBOM reports are generated (`onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline).<br/>:warning: `sbom-disabled` / `GRADLE_SBOM_DISABLED` takes precedence | `onrelease` |

| `sbom-version` / `GRADLE_SBOM_VERSION` | Version of the `cyclonedx-gradle-plugin` used for SBOM analysis<br/>_When unset, the latest version will be used_ | _none_ |

| `maven-plugin-url` / `GRADLE_MAVEN_PLUGIN_URL` | Maven Repository that is used to download the `cyclonedx-gradle-plugin`. No trailing slash. | https://plugins.gradle.org/m2 |

kicker.json

+8 −0
Original line number Diff line number Diff line
@@ -103,6 +103,14 @@ 
      "description": "This job generates a file listing all dependencies using [cyclonedx-gradle-plugin](https://github.com/CycloneDX/cyclonedx-gradle-plugin)",

      "disable_with": "GRADLE_SBOM_DISABLED",

      "variables": [

        {

          "name": "TBC_SBOM_MODE",

          "type": "enum",

          "values": ["onrelease", "always"],

          "description": "Controls when SBOM reports are generated (`onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline)",

          "advanced": true,

          "default": "onrelease"

        },

        {

          "name": "GRADLE_SBOM_VERSION",

          "description": "Version of the `cyclonedx-gradle-plugin` used for SBOM analysis.\n\n_When unset, the latest version will be used_"

templates/gitlab-ci-gradle.yml

+20 −1
Original line number Diff line number Diff line
@@ -131,7 +131,18 @@ workflow: 
    # else (Ready MR): auto & failing

    - when: on_success



# software delivery job prototype: run on production and integration branches + release pipelines

.delivery-policy:

  rules:

    # on tag with release pattern

    - if: '$CI_COMMIT_TAG =~ $RELEASE_REF'

    # on production or integration branch(es)

    - if: '$CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF'



variables:

  # Global TBC SBOM Mode (onrelease -> only generate SBOMs for releases, always -> generate SBOMs for all refs)

  TBC_SBOM_MODE: "onrelease"



  GRADLE_IMAGE: $[[ inputs.image ]]

  GRADLE_CLI_BIN: $[[ inputs.cli-bin ]]

  GRADLE_CLI_OPTS: $[[ inputs.cli-opts ]]
@@ -163,6 +174,8 @@ variables: 
  PROD_REF: /^(master|main)$/

  # default integration ref name (pattern)

  INTEG_REF: /^develop$/

  # default release tag name (pattern)

  RELEASE_REF: '/^v?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9-\.]+)?(\+[a-zA-Z0-9-\.]+)?$/'



stages:

  - build
@@ -624,7 +637,13 @@ gradle-sbom: 
    # exclude if disabled

    - if: '$GRADLE_SBOM_DISABLED == "true"'

      when: never

    - !reference [.test-policy, rules] 

    # 'always' mode: run

    - if: '$TBC_SBOM_MODE == "always"'

    # exclude unsupported modes

    - if: '$TBC_SBOM_MODE != "onrelease"'

      when: never

    # 'onrelease' mode: use common software delivery rules

    - !reference [.delivery-policy, rules]



.gradle-base-publish:

  extends: .gradle-base