Merge pull request #27 from CycloneDX/actions-timeouts-permissions

Multiple tweaks to Actions
CycloneDX · Apr 11, 2022 · 6b6070c · 6b6070c
2 parents 404f9a3 + 22c6201
commit 6b6070c
Show file tree

Hide file tree

Showing 3 changed files with 105 additions and 84 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -3,62 +3,67 @@ name: CI
 on:
   push:
     branches:
-      - master
+    - master
   pull_request:
     branches:
-      - master
+    - master
+
+permissions: { }
 
 jobs:
   licensecheck:
     name: License Check
+    timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v3.0.0
-      - name: Check license headers
-        uses: apache/skywalking-eyes@v0.2.0
-        with:
-          config: .licenserc.yml
+    - name: Checkout Repository
+      uses: actions/checkout@v3.0.0
+    - name: Check license headers
+      uses: apache/skywalking-eyes@v0.2.0
+      with:
+        config: .licenserc.yml
 
   lint:
     name: Lint
+    timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v3.0.0
-      - name: Setup Go
-        uses: actions/setup-go@v3.0.0
-        with:
-          go-version: "1.17"
-          check-latest: true
-      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v3.1.0
-        with:
-          version: latest
+    - name: Checkout Repository
+      uses: actions/checkout@v3.0.0
+    - name: Setup Go
+      uses: actions/setup-go@v3.0.0
+      with:
+        go-version: "1.17"
+        check-latest: true
+    - name: Run golangci-lint
+      uses: golangci/golangci-lint-action@v3.1.0
+      with:
+        version: latest
 
   test:
     name: Test
+    timeout-minutes: 5
     runs-on: ubuntu-latest
     strategy:
       matrix:
         go:
-          - "1.15"
-          - "1.16"
-          - "1.17"
+        - "1.15"
+        - "1.16"
+        - "1.17"
     steps:
-      - name: Setup Go
-        uses: actions/setup-go@v3.0.0
-        with:
-          go-version: ${{ matrix.go }}
-          check-latest: true
-      - name: Setup CycloneDX CLI
-        run: |
-          mkdir -p "$HOME/.local/bin"
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-          wget -O "$HOME/.local/bin/cyclonedx" https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.22.0/cyclonedx-linux-x64
-          echo "ae39404a9dc8b2e7be0a9559781ee9fe3492201d2629de139d702fd4535ffdd6 $HOME/.local/bin/cyclonedx" | sha256sum -c
-          chmod +x "$HOME/.local/bin/cyclonedx"
-      - name: Checkout Repository
-        uses: actions/checkout@v3.0.0
-      - name: Test
-        run: make test
+    - name: Setup Go
+      uses: actions/setup-go@v3.0.0
+      with:
+        go-version: ${{ matrix.go }}
+        check-latest: true
+    - name: Setup CycloneDX CLI
+      run: |
+        mkdir -p "$HOME/.local/bin"
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
+        wget -O "$HOME/.local/bin/cyclonedx" https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.0/cyclonedx-linux-x64
+        echo "691cf7ed82ecce1f85e6d21bccd1ed2d7968e40eb6be7504b392c8b3a0943891 $HOME/.local/bin/cyclonedx" | sha256sum -c
+        chmod +x "$HOME/.local/bin/cyclonedx"
+    - name: Checkout Repository
+      uses: actions/checkout@v3.0.0
+    - name: Test
+      run: make test
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
@@ -1,32 +1,36 @@
-name: goreleaser
+name: GoReleaser
 
 on:
   push:
     tags:
-      - 'v*'
+    - 'v*'
+
+permissions:
+  contents: write
 
 jobs:
   goreleaser:
+    name: Release
+    timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v3.0.0
-        with:
-          fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@v3.0.0
-        with:
-          go-version: "1.17"
-          check-latest: true
-      - name: Generate SBOM
-        uses: CycloneDX/gh-gomod-generate-sbom@v1
-        with:
-          version: v1
-          args: mod -licenses -json -output bom.json -type library -verbose
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
-        with:
-          version: latest
-          args: release --rm-dist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Checkout Repository
+      uses: actions/checkout@v3.0.0
+      with:
+        fetch-depth: 0
+    - name: Setup Go
+      uses: actions/setup-go@v3.0.0
+      with:
+        go-version: "1.17"
+        check-latest: true
+    - name: Install cyclonedx-gomod
+      uses: CycloneDX/gh-gomod-generate-sbom@v1
+      with:
+        version: v1
+    - name: Run GoReleaser
+      uses: goreleaser/goreleaser-action@v2
+      with:
+        version: latest
+        args: release --rm-dist
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -1,32 +1,44 @@
 builds:
-  # This is a library project, we don't want to build any binaries.
-  # Building and testing is performed in the CI workflow
-  - skip: true
+# This is a library project, we don't want to build any binaries.
+# Building and testing is performed in the CI workflow
+- skip: true
+
 release:
-  extra_files:
-    - glob: ./bom.json
+  prerelease: auto
+
+source:
+  enabled: true
+
+sboms:
+- artifacts: source
+  documents:
+  - "${artifact}.cdx.sbom"
+  cmd: cyclonedx-gomod
+  args: [ "mod", "-licenses", "-json", "-output", "$document", "./.." ]
+
 milestones:
-  - name_template: "{{ .Tag }}"
-    close: true
+- name_template: "{{ .Tag }}"
+  close: true
+
 changelog:
   use: github
   sort: asc
   groups:
-    - title: Features
-      regexp: "^.*feat[(\\w)]*:+.*$"
-      order: 0
-    - title: Fixes
-      regexp: "^.*fix[(\\w)]*:+.*$"
-      order: 1
-    - title: Building and Packaging
-      regexp: "^.*build[(\\w)]*:+.*$"
-      order: 2
-    - title: Documentation
-      regexp: "^.*docs[(\\w)]*:+.*$"
-      order: 3
-    - title: Others
-      order: 999
+  - title: Features
+    regexp: "^.*feat[(\\w)]*:+.*$"
+    order: 0
+  - title: Fixes
+    regexp: "^.*fix[(\\w)]*:+.*$"
+    order: 1
+  - title: Building and Packaging
+    regexp: "^.*build[(\\w)]*:+.*$"
+    order: 2
+  - title: Documentation
+    regexp: "^.*docs[(\\w)]*:+.*$"
+    order: 3
+  - title: Others
+    order: 999
   filters:
     exclude:
-      - '^test:'
-      - '^Merge '
+    - '^test:'
+    - '^Merge '