feat: initial commit

# Created by https://www.toptal.com/developers/gitignore/api/venv,python,VisualStudioCode

# Edit at https://www.toptal.com/developers/gitignore?templates=venv,python,VisualStudioCode

### Python ###

# Byte-compiled / optimized / DLL files

__pycache__/

*.py[cod]

*$py.class

# C extensions

*.so

# Distribution / packaging

.Python

build/

develop-eggs/

dist/

downloads/

eggs/

.eggs/

lib/

lib64/

parts/

sdist/

var/

wheels/

share/python-wheels/

*.egg-info/

.installed.cfg

*.egg

MANIFEST

# PyInstaller

#  Usually these files are written by a python script from a template

#  before PyInstaller builds the exe, so as to inject date/other infos into it.

*.manifest

*.spec

# Installer logs

pip-log.txt

pip-delete-this-directory.txt

# Unit test / coverage reports

htmlcov/

.tox/

.nox/

.coverage

.coverage.*

.cache

nosetests.xml

coverage.xml

*.cover

*.py,cover

.hypothesis/

.pytest_cache/

cover/

# Translations

*.mo

*.pot

# Django stuff:

*.log

local_settings.py

db.sqlite3

db.sqlite3-journal

# Flask stuff:

instance/

.webassets-cache

# Scrapy stuff:

.scrapy

# Sphinx documentation

docs/_build/

# PyBuilder

.pybuilder/

target/

# Jupyter Notebook

.ipynb_checkpoints

# IPython

profile_default/

ipython_config.py

# pyenv

#   For a library or package, you might want to ignore these files since the code is

#   intended to run in multiple environments; otherwise, check them in:

# .python-version

# pipenv

#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.

#   However, in case of collaboration, if having platform-specific dependencies or dependencies

#   having no cross-platform support, pipenv may install dependencies that don't work, or not

#   install all needed dependencies.

#Pipfile.lock

# poetry

#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.

#   This is especially recommended for binary packages to ensure reproducibility, and is more

#   commonly ignored for libraries.

#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control

#poetry.lock

# pdm

#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.

#pdm.lock

#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it

#   in version control.

#   https://pdm.fming.dev/#use-with-ide

.pdm.toml

# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm

__pypackages__/

# Celery stuff

celerybeat-schedule

celerybeat.pid

# SageMath parsed files

*.sage.py

# Environments

.env

.venv

env/

venv/

ENV/

env.bak/

venv.bak/

# Spyder project settings

.spyderproject

.spyproject

# Rope project settings

.ropeproject

# mkdocs documentation

/site

# mypy

.mypy_cache/

.dmypy.json

dmypy.json

# Pyre type checker

.pyre/

# pytype static type analyzer

.pytype/

# Cython debug symbols

cython_debug/

# PyCharm

#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can

#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore

#  and can be added to the global gitignore or merged into this file.  For a more nuclear

#  option (not recommended) you can uncomment the following to ignore the entire idea folder.

#.idea/

### Python Patch ###

# Poetry local configuration file - https://python-poetry.org/docs/configuration/#local-configuration

poetry.toml

### venv ###

# Virtualenv

# http://iamzed.com/2009/05/07/a-primer-on-virtualenv/

[Bb]in

[Ii]nclude

[Ll]ib

[Ll]ib64

[Ll]ocal

[Ss]cripts

pyvenv.cfg

pip-selfcheck.json

### VisualStudioCode ###

.vscode/*

!.vscode/settings.json

!.vscode/tasks.json

!.vscode/launch.json

!.vscode/extensions.json

!.vscode/*.code-snippets

# Local History for Visual Studio Code

.history/

# Built Visual Studio Code Extensions

*.vsix

### VisualStudioCode Patch ###

# Ignore all local history of files

.history

.ionide

# End of https://www.toptal.com/developers/gitignore/api/venv,python,VisualStudioCode

.work/

reports/

.DS_Store

include:

  # $TBC_NAMESPACE is a group variable; can be globally overridden

  # Docker template

  - component: "gitlab.com/$TBC_NAMESPACE/docker/gitlab-ci-docker@5"

    inputs:

      healthcheck-disabled: true

      sbom-disabled: true

      build-args: "--cache-ttl=6h"

      prod-publish-strategy: "auto"

      release-extra-tags: "latest \\g<major>.\\g<minor>\\g<build> \\g<major>\\g<build>"

  # Python template

  - component: "gitlab.com/$TBC_NAMESPACE/python/gitlab-ci-python@7"

    inputs:

      image: "registry.hub.docker.com/library/python:3.12-slim"

      ruff-enabled: true

      sbom-disabled: true

      package-enabled: true

      release-enabled: true

  # semantic-release template

  - component: "gitlab.com/to-be-continuous/semantic-release/gitlab-ci-semrel@3.8"

    inputs:

      auto-release-enabled: true

# disable py-release

py-release:

  rules:

    - when: never

plugins:

  - '@semantic-release/commit-analyzer'

  - '@semantic-release/release-notes-generator'

  - '@semantic-release/gitlab'

  # generates the CHANGELOG.md

  - '@semantic-release/changelog'

  # emulates bumpversion (replaces version in pyproject.toml)

  - - semantic-release-replace-plugin

    - replacements:

        - files:

            - pyproject.toml

          from:

            - ^version *= *"\d+\.\d+\.\d+"

          to: 'version = "${nextRelease.version}"'

          countMatches: true

  # git commit/push modified files (CHANGELOG.md & pyproject.toml)

  - - '@semantic-release/git'

    - assets:

        - '*.md'

        - '*.toml'

      # the commit MUST trigger a pipeline on tag (to perform publish jobs)

      # can be skipped on prod branch

      message: 'chore(semantic-release): release ${nextRelease.version} - [ci skip on prod]'

branches:

  - main

  - master

tagFormat: '${version}'

FROM registry.hub.docker.com/library/python:3.12-alpine

WORKDIR /code

COPY ./dist/*.whl /code/

# hadolint ignore=DL3018

RUN apk upgrade --no-cache \

    && apk add git --no-cache \

    && pip install --no-cache-dir /code/*.whl

ENTRYPOINT [ "sbom-scanner" ]

CMD [ "." ]

 No newline at end of file

MIT License

Copyright (C) 2024 Pierre Smeyers and contributors

Permission is hereby granted, free of charge, to any person obtaining a copy

of this software and associated documentation files (the "Software"), to deal

in the Software without restriction, including without limitation the rights

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

copies of the Software, and to permit persons to whom the Software is

furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

SOFTWARE.