Skip to content

Commit 744fa7e

Browse files
bomly-guybomly-guy
committed
Initial commit
0 parents  commit 744fa7e

295 files changed

Lines changed: 68842 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.githooks/pre-commit‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/usr/bin/env sh
2+
set -eu
3+
4+
make fmt-check
5+
make lint

‎.github/copilot-instructions.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Copilot Instructions\n\nSee [AGENTS.md](../AGENTS.md) — that is the single source of truth for agent instructions in this repo.

‎.github/dependabot.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "gomod" # See documentation for possible values
9+
directory: "/" # Location of package manifests
10+
schedule:
11+
interval: "weekly"
12+
- package-ecosystem: "github-actions"
13+
directory: "/"
14+
schedule:
15+
interval: "weekly"

‎.github/workflows/auto-version.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
name: Auto Version
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
actions: write
10+
contents: write
11+
12+
concurrency:
13+
group: auto-version-main
14+
cancel-in-progress: false
15+
16+
jobs:
17+
bump-tag-and-release:
18+
if: github.actor != 'github-actions[bot]' && !contains(github.event.head_commit.message, '[skip release]')
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Check out repository
22+
uses: actions/checkout@v5
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Compute next version
27+
id: version
28+
shell: bash
29+
run: |
30+
set -euo pipefail
31+
32+
latest_tag="$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1)"
33+
if [[ -n "${latest_tag}" ]]; then
34+
current="${latest_tag#v}"
35+
messages="$(git log --format=%B "${latest_tag}..HEAD")"
36+
else
37+
current="$(sed -nE 's/^var version = "([^"]+)"/\1/p' cmd/bomly/main.go | head -n 1)"
38+
messages="$(git log --format=%B -n 1 HEAD)"
39+
fi
40+
41+
if [[ ! "${current}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
42+
echo "Current version ${current} is not semver MAJOR.MINOR.PATCH" >&2
43+
exit 1
44+
fi
45+
46+
IFS=. read -r major minor patch <<< "${current}"
47+
if grep -Eq '(^[a-zA-Z]+(\([^)]+\))?!:|BREAKING CHANGE:)' <<< "${messages}"; then
48+
major=$((major + 1))
49+
minor=0
50+
patch=0
51+
elif grep -Eq '^feat(\([^)]+\))?:' <<< "${messages}"; then
52+
minor=$((minor + 1))
53+
patch=0
54+
else
55+
patch=$((patch + 1))
56+
fi
57+
58+
next="${major}.${minor}.${patch}"
59+
tag="v${next}"
60+
if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
61+
echo "Tag ${tag} already exists" >&2
62+
exit 1
63+
fi
64+
65+
echo "version=${next}" >> "$GITHUB_OUTPUT"
66+
echo "tag=${tag}" >> "$GITHUB_OUTPUT"
67+
68+
- name: Update source version
69+
shell: bash
70+
env:
71+
VERSION: ${{ steps.version.outputs.version }}
72+
run: |
73+
set -euo pipefail
74+
sed -i -E "s/^var version = \"[^\"]+\"/var version = \"${VERSION}\"/" cmd/bomly/main.go
75+
git diff -- cmd/bomly/main.go
76+
77+
- name: Commit version bump and tag
78+
shell: bash
79+
env:
80+
VERSION: ${{ steps.version.outputs.version }}
81+
TAG: ${{ steps.version.outputs.tag }}
82+
run: |
83+
set -euo pipefail
84+
85+
git config user.name "github-actions[bot]"
86+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
87+
88+
git add cmd/bomly/main.go
89+
git commit -m "chore(release): ${TAG} [skip ci]"
90+
git tag -a "${TAG}" -m "Release ${TAG}"
91+
git push origin HEAD:main
92+
git push origin "${TAG}"
93+
94+
- name: Start release workflow
95+
env:
96+
GITHUB_TOKEN: ${{ github.token }}
97+
TAG: ${{ steps.version.outputs.tag }}
98+
run: gh workflow run release.yml --ref "${TAG}"

‎.github/workflows/ci.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: CI
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: ci-${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
validate:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Check out repository
21+
uses: actions/checkout@v5
22+
23+
- name: Set up Go
24+
uses: actions/setup-go@v6
25+
with:
26+
go-version-file: go.mod
27+
cache: true
28+
cache-dependency-path: |
29+
go.sum
30+
31+
- name: Run golangci-lint
32+
run: make lint
33+
34+
- name: Run unit and integration tests
35+
run: make test
36+
37+
- name: Run go vet
38+
run: go vet ./...
39+
40+
- name: Build default Bomly binary
41+
run: go build -o /tmp/bomly ./cmd/bomly
42+
43+
- name: Build lite Bomly binary
44+
run: go build -tags "bomly_external_syft,bomly_external_grype" -o /tmp/bomly-lite ./cmd/bomly
45+
46+
- name: Check Go formatting
47+
run: make fmt-check
48+
49+
- name: Check module metadata drift
50+
shell: bash
51+
run: |
52+
set -euo pipefail
53+
go mod tidy
54+
git diff --exit-code -- go.mod go.sum
55+
56+
- name: Check generated documentation drift
57+
shell: bash
58+
run: |
59+
set -euo pipefail
60+
make generate
61+
git diff --exit-code

‎.github/workflows/release.yml‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: write
11+
12+
concurrency:
13+
group: release-${{ github.ref }}
14+
cancel-in-progress: false
15+
16+
jobs:
17+
validate:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Check out repository
21+
uses: actions/checkout@v5
22+
23+
- name: Set up Go
24+
uses: actions/setup-go@v6
25+
with:
26+
go-version-file: go.mod
27+
cache: true
28+
cache-dependency-path: |
29+
go.sum
30+
31+
- name: Run test suite
32+
run: make test
33+
34+
- name: Run go vet
35+
run: go vet ./...
36+
37+
package:
38+
needs: validate
39+
runs-on: ubuntu-latest
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
include:
44+
- goos: linux
45+
goarch: amd64
46+
- goos: linux
47+
goarch: arm64
48+
- goos: darwin
49+
goarch: amd64
50+
- goos: darwin
51+
goarch: arm64
52+
- goos: windows
53+
goarch: amd64
54+
- goos: windows
55+
goarch: arm64
56+
steps:
57+
- name: Check out repository
58+
uses: actions/checkout@v5
59+
60+
- name: Set up Go
61+
uses: actions/setup-go@v6
62+
with:
63+
go-version-file: go.mod
64+
cache: true
65+
cache-dependency-path: |
66+
go.sum
67+
68+
- name: Build release archives
69+
shell: bash
70+
env:
71+
GOOS: ${{ matrix.goos }}
72+
GOARCH: ${{ matrix.goarch }}
73+
VERSION: ${{ github.ref_name }}
74+
run: |
75+
set -euo pipefail
76+
77+
repo_root="${PWD}"
78+
binary_version="${VERSION#v}"
79+
ext=""
80+
archive_ext="tar.gz"
81+
if [[ "${GOOS}" == "windows" ]]; then
82+
ext=".exe"
83+
archive_ext="zip"
84+
fi
85+
86+
mkdir -p dist
87+
88+
build_archive() {
89+
local archive_base="$1"
90+
local binary_name="$2"
91+
local build_tags="$3"
92+
local stage_dir
93+
stage_dir="$(mktemp -d)"
94+
95+
if [[ -n "${build_tags}" ]]; then
96+
GOOS="${GOOS}" GOARCH="${GOARCH}" CGO_ENABLED=0 go build \
97+
-trimpath \
98+
-tags "${build_tags}" \
99+
-ldflags "-s -w -X main.version=${binary_version}" \
100+
-o "${stage_dir}/${binary_name}${ext}" \
101+
./cmd/bomly
102+
else
103+
GOOS="${GOOS}" GOARCH="${GOARCH}" CGO_ENABLED=0 go build \
104+
-trimpath \
105+
-ldflags "-s -w -X main.version=${binary_version}" \
106+
-o "${stage_dir}/${binary_name}${ext}" \
107+
./cmd/bomly
108+
fi
109+
110+
local archive_path="dist/${archive_base}_${VERSION}_${GOOS}_${GOARCH}.${archive_ext}"
111+
if [[ "${archive_ext}" == "zip" ]]; then
112+
(
113+
cd "${stage_dir}"
114+
zip -q "${repo_root}/${archive_path}" "${binary_name}${ext}"
115+
)
116+
else
117+
tar -C "${stage_dir}" -czf "${archive_path}" "${binary_name}${ext}"
118+
fi
119+
120+
rm -rf "${stage_dir}"
121+
}
122+
123+
build_archive "bomly" "bomly" ""
124+
build_archive "bomly-lite" "bomly-lite" "bomly_external_syft,bomly_external_grype"
125+
126+
- name: Upload packaged artifacts
127+
uses: actions/upload-artifact@v4
128+
with:
129+
name: release-${{ matrix.goos }}-${{ matrix.goarch }}
130+
path: dist/*
131+
132+
publish:
133+
needs: package
134+
runs-on: ubuntu-latest
135+
permissions:
136+
contents: write
137+
steps:
138+
- name: Check out repository
139+
uses: actions/checkout@v5
140+
with:
141+
fetch-depth: 0
142+
143+
- name: Download packaged artifacts
144+
uses: actions/download-artifact@v5
145+
with:
146+
path: dist
147+
pattern: release-*
148+
merge-multiple: true
149+
150+
- name: Generate checksums
151+
shell: bash
152+
run: |
153+
set -euo pipefail
154+
find dist -maxdepth 1 -type f | sort | xargs sha256sum > dist/SHA256SUMS
155+
156+
- name: Write release notes
157+
shell: bash
158+
run: |
159+
cat > RELEASE_NOTES.md <<'EOF'
160+
Bomly release ${{ github.ref_name }}
161+
162+
Assets in this draft prerelease include:
163+
- Full builtin `bomly` archives for Linux, macOS, and Windows
164+
- Alternate `bomly-lite` archives for users who prefer external Syft/Grype binaries
165+
- `SHA256SUMS` for release verification
166+
167+
GitHub-native artifact attestations are intentionally deferred while the repository remains private on a non-Enterprise plan.
168+
EOF
169+
170+
- name: Publish draft prerelease
171+
env:
172+
GITHUB_TOKEN: ${{ github.token }}
173+
TAG: ${{ github.ref_name }}
174+
run: |
175+
if gh release view "${TAG}" >/dev/null 2>&1; then
176+
gh release upload "${TAG}" dist/* --clobber
177+
else
178+
gh release create "${TAG}" dist/* \
179+
--title "Bomly ${TAG}" \
180+
--notes-file RELEASE_NOTES.md \
181+
--draft \
182+
--prerelease
183+
fi

0 commit comments

Comments
 (0)