Skip to content

On Pre-Release

On Pre-Release #64

Workflow file for this run

# SPDX-License-Identifier: Apache-2.0
# Licensed to the Ed-Fi Alliance under one or more agreements.
# The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
# See the LICENSE and NOTICES files in the project root for more information.
name: On Pre-Release
on:
release:
types:
- prereleased
permissions: read-all
env:
ARTIFACTS_API_KEY: ${{ secrets.AZURE_ARTIFACTS_PERSONAL_ACCESS_TOKEN }}
AZURE_ARTIFACT_URL: "https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_packaging/EdFi/nuget/v3/index.json"
VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: '{"endpointCredentials": [{"endpoint": "https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_packaging/EdFi/nuget/v3/index.json","password": "${{ secrets.AZURE_ARTIFACTS_PERSONAL_ACCESS_TOKEN }}"}]}'
MANIFEST_FILE: "_manifest/spdx_2.2/manifest.spdx.json"
PACKAGE_NAME: "EdFi.ApiPublisher"
jobs:
pack:
name: Build and Pack
runs-on: ubuntu-latest
defaults:
run:
shell: pwsh
outputs:
hash-code: ${{ steps.hash-code.outputs.hash-code }}
api-pub-version: ${{ steps.versions.outputs.api-pub }}
steps:
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
- name: Set Version Numbers
id: versions
run: |
$appPrefix = "v"
# Install the MinVer CLI tool
&dotnet tool install --global minver-cli
$appVersion = $(minver -t $appPrefix)
# Full release name
"api-pub=$appVersion" >> $env:GITHUB_OUTPUT
# SemVer
"api-pub-semver=$($appVersion -Replace $appPrefix)" >> $env:GITHUB_OUTPUT
- name: Setup .NET
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3.0.3
with:
dotnet-version: 8.0.x
- name: Publish .NET Assemblies
run: |
$appVersion = "${{ steps.versions.outputs.api-pub-semver }}"
./build.ps1 -Command BuildAndPublish `
-Configuration Release `
-Version $appVersion
- name: Setup Nuget.exe
uses: nuget/setup-nuget@a21f25cd3998bf370fde17e3f1b4c12c175172f9 #v2.0.0
- name: Create NuGet Packages
if: success()
run: |
$appVersion = "${{ steps.versions.outputs.api-pub-semver }}"
"Building ${{ env.PACKAGE_NAME }} NuGet Package" | Write-Output
# ApiPublisher
./build.ps1 -Command Package `
-Version $appVersion `
-Configuration Release
- name: Generate hash for NuGet package
id: hash-code
shell: bash
run: |
echo "hash-code=$(sha256sum *.nupkg | base64 -w0)" >> $GITHUB_OUTPUT
- name: Upload Packages as Artifacts
if: success()
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
with:
name: "${{ env.PACKAGE_NAME }}-NuGet"
path: ./*.nupkg
if-no-files-found: error
retention-days: 30
sbom-create:
name: Create SBOM
runs-on: ubuntu-latest
needs: pack
permissions:
actions: read
contents: write
outputs:
sbom-hash-code: ${{ steps.sbom-hash-code.outputs.sbom-hash-code }}
steps:
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Get Artifacts
uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 #v4.1.1
with:
name: ${{ env.PACKAGE_NAME }}-NuGet
- name: Generate Software Bill of Materials (SBOM) - API
shell: pwsh
run: |
$packageName = "${{ env.PACKAGE_NAME }}"
$version = "${{ needs.pack.outputs.data-import-version }}"
$url = "https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64"
$out = "$($env:RUNNER_TEMP)/sbom-tool"
Invoke-RestMethod -Uri $url -OutFile $out
chmod +x $out
Get-ChildItem -Include "$packageName.*.nupkg" -Recurse | ForEach-Object { $_.FullName } > buildfilelist.txt
New-Item -Path manifest -Type Directory
dotnet tool install --global Microsoft.Sbom.DotNetTool
sbom-tool generate `
-b ./ `
-bl ./buildfilelist.txt `
-bc "./src/EdFi.Tools.ApiPublisher.Cli" `
-pn "$packageName" `
-pv $version `
-nsb https://ed-fi.org `
-m ./ `
-ps "Ed-Fi Alliance"
- name: Upload SBOM
if: success()
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
with:
name: ${{ env.PACKAGE_NAME }}-SBOM
path: ${{ env.MANIFEST_FILE }}
if-no-files-found: error
retention-days: 30
- name: Generate hash code for SBOM
id: sbom-hash-code
shell: bash
run: |
# sha256sum returns "<hashcode> <name of file". Split that and return only the <hashcode>.
sbom_hash=$(sha256sum ./${{ env.MANIFEST_FILE }} | awk '{split($0,a); print a[1]}')
echo "sbom-hash-code=$sbom_hash" >> $GITHUB_OUTPUT
sbom-attach:
name: Attach SBOM file
runs-on: ubuntu-latest
needs:
- sbom-create
- pack
permissions:
actions: read
contents: write
steps:
- name: Download the SBOM
uses: Ed-Fi-Alliance-OSS/slsa-github-generator/.github/actions/secure-download-artifact@main
with:
name: "${{ env.PACKAGE_NAME }}-SBOM"
path: ${{ env.MANIFEST_FILE }}
sha256: "${{ needs.sbom-create.outputs.sbom-hash-code }}"
- name: Attach to release
shell: pwsh
run: |
$release = "${{ github.ref_name }}"
$repo = "${{ github.repository }}"
$token = "${{ secrets.GITHUB_TOKEN }}"
$file = "${{ env.MANIFEST_FILE }}"
$uploadName = "${{ env.PACKAGE_NAME }}-SBOM.zip"
$url = "https://api.github.com/repos/$repo/releases/tags/$release"
$gh_headers = @{
"Accept" = "application/vnd.github+json"
"Authorization" = "Bearer $token"
}
$response = Invoke-RestMethod -Uri $url -Headers $gh_headers
$releaseId = $response.id
$url = "https://uploads.github.com/repos/$repo/releases/$releaseId/assets"
Compress-Archive $file -DestinationPath $uploadName
$gh_headers["Content-Type"] = "application/octet"
Invoke-RestMethod -Method POST `
-Uri "$($url)?name=$($uploadName)" `
-Headers $gh_headers `
-InFile $uploadName
provenance-create:
name: Create Provenance
needs: pack
permissions:
actions: read
id-token: write
contents: write
uses: Ed-Fi-Alliance-OSS/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@main
with:
base64-subjects: ${{ needs.pack.outputs.hash-code }}
provenance-name: EdFi.ApiPublisher.intoto.jsonl
upload-assets: true
# TODO: remove this after this issue is resolved: https://github.com/slsa-framework/slsa-github-generator/issues/876
compile-generator: true
publish-package:
name: Publish NuGet Package
needs: pack
runs-on: ubuntu-latest
defaults:
run:
shell: pwsh
steps:
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Get Artifact
uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 #v4.1.1
with:
name: ${{ env.PACKAGE_NAME }}-NuGet
- name: Install-credential-handler
run: iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx"
- name: Push Package to Azure Artifacts
run: |
$artifact = (Get-ChildItem -Path $_ -Name -Include *.nupkg)
$arguments = @{
EdFiNuGetFeed = "${{ env.AZURE_ARTIFACT_URL }}"
NuGetApiKey = "${{ env.ARTIFACTS_API_KEY }}"
}
$artifact | ForEach-Object {
$arguments.PackageFile = $_
./build.ps1 Push @arguments
}