Repository navigation
CI and SBOM updated #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: [ "master", "ci" ] | |
| tags: | |
| - "v*" | |
| pull_request: | |
| branches: [ "master" ] | |
| jobs: | |
| build: | |
| runs-on: windows-2025 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup MSBuild | |
| uses: microsoft/setup-msbuild@v3 | |
| - name: Setup NuGet | |
| uses: NuGet/setup-nuget@v4 | |
| - name: Restore Packages | |
| run: MSBuild.exe -p:Configuration="Release" -t:restore | |
| - name: Build | |
| run: MSBuild.exe -p:Configuration="Release" | |
| - name: Export binaries | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: PositionInterfaceClient.zip | |
| path: ${{ github.workspace }}/bin/Release | |
| # For some reason sbomify with cdxgen fails to generate the initial SBOM (although it works with other repos) | |
| # Instead we generate it here like this | |
| - name: Generate initial SBOM | |
| uses: CycloneDX/gh-dotnet-generate-sbom@master | |
| with: | |
| path: ./PositionInterfaceClient.sln | |
| json: true | |
| github-bearer-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Export initial SBOM | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: sbom_temp1.cdx.json | |
| path: bom.json | |
| sbom_pt1: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Liest die Core-Version aus dem NSIS-Installer-Skript | |
| - name: Get software version | |
| run: | | |
| VER_MAJOR=`grep -E -o "SWVersionMajor[[:blank:]]+=[[:blank:]][[:digit:]]+" MainWindow.xaml.cs | sed "s/[^0-9.]*//g"` | |
| VER_MINOR=`grep -E -o "SWVersionMinor[[:blank:]]+=[[:blank:]][[:digit:]]+" MainWindow.xaml.cs | sed "s/[^0-9.]*//g"` | |
| VER_PATCH=`grep -E -o "SWVersionPatch[[:blank:]]+=[[:blank:]][[:digit:]]+" MainWindow.xaml.cs | sed "s/[^0-9.]*//g"` | |
| echo "Software version '$VER_MAJOR.$VER_MINOR.$VER_PATCH' detected" | |
| echo "SW_VERSION=$VER_MAJOR.$VER_MINOR.$VER_PATCH" >> $GITHUB_ENV | |
| - name: Import temporary SBOM | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sbom_temp1.cdx.json | |
| # SBOM erstellen | |
| # Wie man die packages.lock.json bekommt: https://devblogs.microsoft.com/dotnet/enable-repeatable-package-restores-using-a-lock-file/ | |
| - uses: sbomify/sbomify-action@master | |
| env: | |
| SBOM_FILE: bom.json | |
| #LOCK_FILE: packages.lock.json | |
| OUTPUT_FILE: sbom_temp2.cdx.json | |
| COMPONENT_NAME: PositionInterfaceClient | |
| COMPONENT_VERSION: ${{ env.SW_VERSION }} | |
| # Produkt- und Firmeninfo werden aus sbomify.json geladen | |
| AUGMENT: true | |
| # Metadaten aus Paket-Registry hinzufügen | |
| ENRICH: true | |
| # Metadaten aus additional_packages.txt hinzufügen | |
| #ADDITIONAL_PACKAGES_FILE: ${{ github.workspace }}/additional_packages.txt | |
| UPLOAD: false | |
| - name: Export incomplete SBOM | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom_temp2.cdx.json | |
| path: sbom_temp2.cdx.json | |
| archive: false | |
| sbom_pt2: | |
| runs-on: windows-2025 | |
| timeout-minutes: 10 | |
| needs: sbom_pt1 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Import temporary SBOM | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sbom_temp2.cdx.json | |
| - name: Import binaries | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: PositionInterfaceClient.zip | |
| skip-decompress: true | |
| - name: Final SBOM enrichment | |
| uses: CommonplaceRobotics/Action_SBOM_Enrichment@v9 | |
| with: | |
| database: .github/workflows/sbom_enrichment_db.json | |
| sbom: sbom_temp2.cdx.json | |
| sbom_out: sbom.cdx.json | |
| msproj_file: PositionInterfaceClient.csproj | |
| - name: Export SBOM | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| path: sbom.cdx.json | |
| archive: false | |
| - name: Validate SBOM with company policies | |
| uses: CommonplaceRobotics/Action_Validate_SBOM@v6 | |
| with: | |
| sbom: sbom.cdx.json | |
| release: | |
| name: Publish GitHub Release | |
| needs: sbom_pt2 | |
| runs-on: ubuntu-latest | |
| if: startsWith(github.ref, 'refs/tags/') | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Import binaries | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: PositionInterfaceClient.zip | |
| path: dist/ | |
| skip-decompress: true | |
| - name: Import SBOM | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sbom.cdx.json | |
| path: dist/ | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: dist/* | |
| generate_release_notes: true |