@catladder/pipeline 1.97.2 → 1.98.0

package/examples/__snapshots__/wait-for-other-deploy.ts.snap

@@ -240,6 +240,55 @@ exports[`matches snapshot 1`] = `
           "KUBERNETES_MEMORY_REQUEST": "2Gi",
         },
       },
+      "api 🧾 sbom upload | dev ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "api 🧾 sbom | dev ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/api" "dev" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "api 🧾 sbom | dev ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "api 🚀 Deploy | dev ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" api",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
       "www 👮 lint": {
         "cache": [
           {
@@ -479,6 +528,55 @@ exports[`matches snapshot 1`] = `
           "KUBERNETES_MEMORY_REQUEST": "2Gi",
         },
       },
+      "www 🧾 sbom upload | dev ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "www 🧾 sbom | dev ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/www" "dev" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "www 🧾 sbom | dev ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "www 🚀 Deploy | dev ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" www",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
     },
     "stages": [
       "setup",
@@ -786,6 +884,55 @@ exports[`matches snapshot 1`] = `
           "KUBERNETES_MEMORY_REQUEST": "2Gi",
         },
       },
+      "api 🧾 sbom upload | review ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "api 🧾 sbom | review ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/api" "review" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "api 🧾 sbom | review ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "api 🚀 Deploy | review ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" api",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
       "www 👮 lint": {
         "cache": [
           {
@@ -1025,6 +1172,55 @@ exports[`matches snapshot 1`] = `
           "KUBERNETES_MEMORY_REQUEST": "2Gi",
         },
       },
+      "www 🧾 sbom upload | review ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "www 🧾 sbom | review ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/www" "review" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "www 🧾 sbom | review ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "www 🚀 Deploy | review ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" www",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
     },
     "stages": [
       "setup",
@@ -1321,6 +1517,104 @@ exports[`matches snapshot 1`] = `
           "_ALL_ENV_VAR_KEYS": "["ENV_SHORT","APP_DIR","ENV_TYPE","HOST","ROOT_URL"]",
         },
       },
+      "api 🧾 sbom upload | prod ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "api 🧾 sbom | prod ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/api" "prod" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "api 🧾 sbom upload | stage ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "api 🧾 sbom | stage ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/api" "stage" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "api 🧾 sbom | prod ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "api 🚀 Deploy | prod ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" api",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "api 🧾 sbom | stage ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "api 🚀 Deploy | stage ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" api",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
       "www 🔨 app | prod ": {
         "artifacts": {
           "paths": [
@@ -1553,6 +1847,104 @@ exports[`matches snapshot 1`] = `
           "_ALL_ENV_VAR_KEYS": "["ENV_SHORT","APP_DIR","ENV_TYPE","HOST","ROOT_URL"]",
         },
       },
+      "www 🧾 sbom upload | prod ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "www 🧾 sbom | prod ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/www" "prod" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "www 🧾 sbom upload | stage ": {
+        "allow_failure": true,
+        "cache": undefined,
+        "environment": undefined,
+        "image": "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+        "interruptible": true,
+        "needs": [
+          "www 🧾 sbom | stage ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "pan-test-app/www" "stage" "__sbom.json" vex.json",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "www 🧾 sbom | prod ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "www 🚀 Deploy | prod ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" www",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
+      "www 🧾 sbom | stage ": {
+        "allow_failure": true,
+        "artifacts": {
+          "paths": [
+            "__sbom.json",
+          ],
+        },
+        "cache": undefined,
+        "environment": undefined,
+        "image": "aquasec/trivy:0.38.3",
+        "interruptible": true,
+        "needs": [
+          "www 🚀 Deploy | stage ",
+        ],
+        "retry": {
+          "max": 2,
+          "when": [
+            "runner_system_failure",
+            "stuck_or_timeout_failure",
+          ],
+        },
+        "script": [
+          "trivy fs --quiet --format cyclonedx --output "__sbom.json" www",
+        ],
+        "stage": "verify",
+        "variables": {},
+      },
     },
     "stages": [
       "setup",

package/examples/custom-sbom-java.ts

@@ -0,0 +1,34 @@
+import type { Config } from "../src";
+import { createAllPipelines } from "./__utils__/helpers";
+
+const config: Config = {
+  appName: "test-app",
+  customerName: "pan",
+  components: {
+    app: {
+      dir: ".",
+      build: {
+        type: "custom",
+        docker: { type: "custom" },
+        jobImage: "maven:3-eclipse-temurin-11",
+        buildCommand: ["mvn package", "cp -r target dist"],
+        sbom: {
+          jobImage: "maven:3-eclipse-temurin-11",
+          command: [
+            "mvn org.cyclonedx:cyclonedx-maven-plugin:2.7.4:makeBom",
+            "mv target/bom.json __sbom.json",
+          ],
+        },
+      },
+      deploy: {
+        type: "google-cloudrun",
+        projectId: "asdf",
+        region: "asia-east1",
+      },
+    },
+  },
+};
+
+it("matches snapshot", async () => {
+  expect(await createAllPipelines(config)).toMatchSnapshot();
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catladder/pipeline",
-  "version": "1.97.2",
+  "version": "1.98.0",
   "scripts": {
     "build:tsc": "yarn tsc",
     "build": "yarn build:compile && yarn build:inline-variables && yarn build:bundle",

package/src/build/types.ts

@@ -149,6 +149,19 @@ export type BuildConfigCustom = Omit<
     command?: string | string[];
     jobImage?: GitlabJobImage;
   };
+
+  /**
+   * custom sbom (software bill of materials), set false to disable
+   */
+  sbom?:
+    | false
+    | {
+        /**
+         * needs to create a file at `/__sbom.json` in CycloneDX format
+         */
+        command: string | string[];
+        jobImage: GitlabJobImage;
+      };
 };
 
 export type BuildConfigRails = BuildConfigBase & {

package/src/pipeline/createJobsForComponent.ts

@@ -1,5 +1,6 @@
 import { isFunction } from "lodash";
 import { BUILD_TYPES } from "../build";
+import { createReportingJobs } from "../verify/reporting";
 import { createContext } from "../context";
 import { DEPLOY_TYPES } from "../deploy";
 import type { Config, PipelineTrigger } from "../types/config";
@@ -36,9 +37,10 @@ const createRawJobs = (context: Context): CatladderJob[] => {
     BUILD_TYPES[context.componentConfig.build.type].jobs(context);
   const deployJobs =
     DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context);
+  const reportingJobs = createReportingJobs(context);
 
   const customJobs = getCustomJobs(context);
-  return [...buildJobs, ...deployJobs, ...customJobs];
+  return [...buildJobs, ...deployJobs, ...reportingJobs, ...customJobs];
 };
 export const createJobsForComponent = async (
   config: Config,

package/src/verify/reporting.ts

@@ -0,0 +1,69 @@
+import { DEPLOY_JOB_NAME } from "../deploy/base";
+import type { Context } from "../types/context";
+import type { CatladderJob } from "../types/jobs";
+import { ensureArray } from "../utils";
+
+const STAGE = "verify";
+const SBOM_GENERATE_JOB_NAME = "🧾 sbom";
+const SBOM_FILE = "__sbom.json";
+
+const createSbomGenerateJob = (context: Context): CatladderJob => {
+  const buildConfig = context.componentConfig.build;
+
+  const defaultImage = "aquasec/trivy:0.38.3";
+  const defaultScript = [
+    `trivy fs --quiet --format cyclonedx --output "${SBOM_FILE}" ${
+      context.packageManagerInfo?.componentIsInWorkspace
+        ? "."
+        : context.componentConfig.dir
+    }`,
+  ];
+
+  const image =
+    buildConfig.type === "custom" && buildConfig.sbom !== false
+      ? buildConfig.sbom?.jobImage ?? defaultImage
+      : defaultImage;
+
+  const script =
+    buildConfig.type === "custom" && buildConfig.sbom !== false
+      ? ensureArray(buildConfig.sbom?.command) ?? defaultScript
+      : defaultScript;
+
+  return {
+    name: SBOM_GENERATE_JOB_NAME,
+    stage: STAGE,
+    needs: context.componentConfig.deploy !== false ? [DEPLOY_JOB_NAME] : [],
+    envMode: "jobPerEnv",
+    variables: {},
+    cache: undefined,
+    image,
+    script,
+    allow_failure: true,
+    artifacts: {
+      paths: [SBOM_FILE],
+    },
+  };
+};
+
+const createSbomUploadJob = (context: Context): CatladderJob => {
+  return {
+    name: "🧾 sbom upload",
+    stage: STAGE,
+    needs: [SBOM_GENERATE_JOB_NAME],
+    envMode: "jobPerEnv",
+    variables: {},
+    cache: undefined,
+    image:
+      "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+    script: [
+      `/dtrackuploader https://dep.panter.dev/ "$DT_KEY" upload "${context.fullConfig.customerName}-${context.fullConfig.appName}/${context.componentName}" "${context.environment.shortName}" "${SBOM_FILE}" vex.json`,
+    ],
+    allow_failure: true,
+  };
+};
+
+export const createReportingJobs = (context: Context) =>
+  context.componentConfig.build.type === "custom" &&
+  context.componentConfig.build.sbom === false
+    ? []
+    : [createSbomGenerateJob(context), createSbomUploadJob(context)];