Commit fb0adc2d authored by Clement Bois's avatar Clement Bois
Browse files

feat: add a job generating software bill of materials 



Signed-off-by: default avatarClement Bois <clement.bois@orange.com>
parent 09da9e49

README.md

+12 −0
Original line number Diff line number Diff line
@@ -289,3 +289,15 @@ It is bound to the `test` stage. 
| `NODE_OUTDATED_ARGS`      | npm [outdated](https://docs.npmjs.com/cli/v8/commands/npm-outdated) arguments <br/> yarn [outdated](https://classic.yarnpkg.com/lang/en/docs/cli/outdated/) arguments | `--long`                           |



The job generates an outdated report that you will find here: `NODE_PROJECT_DIR/reports/npm-outdated-report.json`.



### `node-sbom` job



This job generates a [SBOM](https://cyclonedx.org/) file listing installed packages using [@cyclonedx/cyclonedx-npm](https://www.npmjs.com/package/@cyclonedx/cyclonedx-npm).



It is bound to the `test` stage, and uses the following variables:



| Name                  | description                            | default value     |

| --------------------- | -------------------------------------- | ----------------- |

| `NODE_SBOM_DISABLED` | Set to `true` to disable this job | _none_ |

| `NODE_SBOM_VERSION` | The version of @cyclonedx/cyclonedx-npm used to emit SBOM | _none_ (uses latest) |

| `NODE_SBOM_OPTS` | Options for @cyclonedx/cyclonedx-npm used for SBOM analysis | `--omit dev` |

kicker.json

+19 −0
Original line number Diff line number Diff line
@@ -97,6 +97,25 @@ 
          "default": "--long"

        }

      ]

    },

    {

      "id": "sbom",

      "name": "Software Bill of Materials",

      "description": "This job generates a file listing all dependencies using [@cyclonedx/cyclonedx-npm](https://www.npmjs.com/package/@cyclonedx/cyclonedx-npm)",

      "disable_with": "NODE_SBOM_DISABLED",

      "variables": [

        {

          "name": "NODE_SBOM_VERSION",

          "description": "Version of the @cyclonedx/cyclonedx-npm used for SBOM analysis",

	  "advanced": true

        },

        {

          "name": "NODE_SBOM_OPTS",

          "description": "Options for @cyclonedx/cyclonedx-npm used for SBOM analysis",

          "default": "--omit dev",

          "advanced": true

        }

      ]

    }

  ]

}

templates/gitlab-ci-node.yml

+23 −0
Original line number Diff line number Diff line
@@ -66,6 +66,8 @@ variables: 
  # Outdated

  NODE_OUTDATED_ARGS: "--long"



  NODE_SBOM_OPTS: "--omit dev"



  # default production ref name (pattern)

  PROD_REF: '/^(master|main)$/'

  # default integration ref name (pattern)
@@ -396,3 +398,24 @@ node-outdated: 
    # on non-production, non-integration branches: manual & non-blocking

    - when: manual

      allow_failure: true



node-sbom:

  extends: .node-base

  stage: test

  # force no dependency

  dependencies: []

  script:

    - mkdir -p -m 777 reports

    - npx -y @cyclonedx/cyclonedx-npm${NODE_SBOM_VERSION:+@$NODE_SBOM_VERSION} --output-format JSON --output-file reports/node-sbom.cyclonedx.json $NODE_SBOM_OPTS

    - chmod a+r reports/node-sbom.cyclonedx.json

  rules:

    # exclude if disabled

    - if: '$NODE_SBOM_DISABLED == "true"'

      when: never

    - !reference [.test-policy, rules]

  artifacts:

    name: "SBOM for Node from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"

    when: always

    expire_in: 1 week

    paths:

      - $NODE_PROJECT_DIR/reports/node-sbom.cyclonedx.json