From 44effb9c67098fad36310c1331b2cdf57f230b15 Mon Sep 17 00:00:00 2001 From: "Gerald Morrison (SAP)" Date: Tue, 1 Apr 2025 11:23:09 +0200 Subject: [PATCH 1/3] chore: add manual workflow for BDBA scan of specified OCM version On-behalf-of: Gerald Morrison (SAP) Signed-off-by: Gerald Morrison (SAP) --- .../workflows/bdba-upload-ctf-manually.yaml | 105 ++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 .github/workflows/bdba-upload-ctf-manually.yaml diff --git a/.github/workflows/bdba-upload-ctf-manually.yaml b/.github/workflows/bdba-upload-ctf-manually.yaml new file mode 100644 index 0000000..4fde750 --- /dev/null +++ b/.github/workflows/bdba-upload-ctf-manually.yaml @@ -0,0 +1,105 @@ +# Workflow to upload released versions, RC or final, Black Duck Binary Analysis (BDBA) for scanning. +# Uses CTF from GitHub release assets. +# This workflow is triggered manually and allows to specify the OCM version to scan. +# Can be used in case the BDBA upload did not work in the release workflow. + +name: BDBA Scan for dedicated OCM version + +on: + workflow_dispatch: + inputs: + OCM_VERSION: + description: 'The OCM version to scan (e.g., 0.22.0)' + required: true + type: string + +permissions: + actions: read + contents: read + +jobs: + upload-and-scan-ctfs: + runs-on: ubuntu-latest + + steps: + # Checkout code from correct repository as executed in .github repo + - name: Checkout code + uses: actions/checkout@v4 + with: + repository: open-component-model/ocm + ref: main + + # Download CTF from GH release assets + - name: Download CTF + run: | + if [ -z "${{ github.event.inputs.OCM_VERSION }}" ]; then + echo "Error: OCM_VERSION parameter is required" + exit 1 + fi + + CTF_URL="https://github.com/open-component-model/ocm/releases/download/v${{ github.event.inputs.OCM_VERSION }}/ocm-${{ github.event.inputs.OCM_VERSION }}-ctf.tgz" + echo "Downloading CTF from: $CTF_URL" + + mkdir -p "${{ github.workspace }}/gen" + curl -L -o "${{ github.workspace }}/gen/ctf-aggregated" "$CTF_URL" + + # Since OCM cli is required to download CVs from CTF, extract binary from CTF + - name: Extract OCM Binary from CTF + id: extract-ocm + run: | + ocm_binary="$(bash ./hack/get_bare_resource_from_ctf.sh \ + "ocm.software/ocmcli" \ + "" \ + "ocmcli" \ + "amd64" \ + "linux" \ + "application/octet-stream" \ + ${{ github.workspace }}/gen/ctf-aggregated)" + + new_loc="${{ github.workspace }}/bin/ocm" + mkdir -p "$(dirname "$new_loc")" + ln -s "$ocm_binary" "$new_loc" + chmod +x "$new_loc" + echo "OCM binary linked to \"$new_loc\"" + echo "binary=\"$new_loc\"" >> "$GITHUB_OUTPUT" + + # Download CVs from CTF as TAR, loop over all TARs and upload them to BDBA + - name: Upload CVs from CTF from GH assets to Blackduck + id: blackduck-upload-ctf + run: | + set -e # Exit immediately if any command fails with non-zero status + echo "Download CVs from CTF (creates CommonTransportFormat-ctf root folder)" + echo "Upload single CVs to BDBA" + echo "Large files may take a while to upload. Please be patient." + echo + cd ${{ github.workspace }}/gen/ + ${{ steps.extract-ocm.outputs.binary }} download cv --type tar ${{ github.workspace }}/gen/ctf-aggregated + # Find all CV tar files within CommonTransportFormat-ctf + find "CommonTransportFormat-${{ github.workspace }}/gen/ctf-aggregated" -type f -print0 | while IFS= read -r -d '' file; do + # Extract the relative path and construct the upload name + relative_path="${file#CommonTransportFormat-${{ github.workspace }}/gen/ctf-aggregated/}" + upload_name="${relative_path%/*}" + upload_name="${upload_name//\//-}" + + # Extract the version from the filename + version=$(basename "$file") + version="${version%.tar}" + + # Construct the API URL + api_url="${{ secrets.BDBA_URL }}/api/upload/${upload_name}" + + # Upload the file using curl + echo "Uploading $upload_name to BDBA" + curl_output=$(curl -sS -X PUT -H "Authorization: Bearer ${{ secrets.BDBA_API_TOKEN }}" -H "Group: ${{ secrets.BDBA_GROUP_ID }}" -H "Version: $version" -H "Delete-Binary: true" --data-binary "@$file" "$api_url") + + # Check if upload was successful and print results + if [[ $(echo "$curl_output" | jq '.meta.code') == "200" ]]; then + echo "--- Upload successful ---" + echo " filename: $(echo "$curl_output" | jq '.results.filename')" + echo " last_updated: $(echo "$curl_output" | jq '.results.last_updated')" + else + echo "Upload failed with" + echo "$curl_output" + exit 1 + fi + done From 1031bcbac8c6e5051bf0c020bbdd3f16df002ac2 Mon Sep 17 00:00:00 2001 From: "Gerald Morrison (SAP)" Date: Tue, 1 Apr 2025 12:40:53 +0200 Subject: [PATCH 2/3] chore: enhance BDBA token rotation workflow with error handling and response validation On-behalf-of: Gerald Morrison (SAP) Signed-off-by: Gerald Morrison (SAP) --- .github/workflows/rotate-bdba-token.yml | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/.github/workflows/rotate-bdba-token.yml b/.github/workflows/rotate-bdba-token.yml index 1713162..439f5f0 100644 --- a/.github/workflows/rotate-bdba-token.yml +++ b/.github/workflows/rotate-bdba-token.yml @@ -27,18 +27,32 @@ jobs: run: | # Generate new token from the Black Duck Binary Analysis API # Using the validity period of 3024000 seconds (35 days) - RESPONSE=$(curl -s -X PUT \ - -H "Content-Type: application/json" \ + RESPONSE=$(curl -s -X POST \ -H "Authorization: Bearer ${{ secrets.BDBA_API_TOKEN }}" \ -d '{"validity": 3024000}' \ "https://bdba.tools.sap/api/key/") + + # Check for curl errors + if [ $? -ne 0 ]; then + echo "::error::Failed to connect to BDBA API" + exit 1 + fi - # Extract token from response + # Extract token and error message TOKEN=$(echo "$RESPONSE" | jq -r '.key.value') + ERROR=$(echo "$RESPONSE" | jq -r '.meta.error') + CODE=$(echo "$RESPONSE" | jq -r '.meta.code') + REASON=$(echo "$RESPONSE" | jq -r '.meta.reason') # Verify token was generated successfully + if [ -n "$ERROR" ] && [ "$ERROR" != "null" ]; then + echo "::error::BDBA API Error ($CODE): $ERROR - $REASON" + exit 1 + fi + if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then - echo "Failed to generate new token. API response: $RESPONSE" + echo "::error::Failed to extract token from API response" + echo "::debug::Full API response: $RESPONSE" exit 1 fi @@ -59,4 +73,4 @@ jobs: --visibility all \ --body "${{ steps.generate-bdba-token.outputs.bdba_token }}" - echo "BDBA API token successfully rotated at $(date)" + echo "BDBA API token successfully rotated at $(date). Valid for 35 days." From f5b2db7fa0dc7ff0b89120aa4322c9361c824dd8 Mon Sep 17 00:00:00 2001 From: "Gerald Morrison (SAP)" Date: Tue, 1 Apr 2025 12:53:23 +0200 Subject: [PATCH 3/3] chore: improve error handling in BDBA token rotation workflow On-behalf-of: Gerald Morrison (SAP) Signed-off-by: Gerald Morrison (SAP) --- .github/workflows/rotate-bdba-token.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/rotate-bdba-token.yml b/.github/workflows/rotate-bdba-token.yml index 439f5f0..b376bb3 100644 --- a/.github/workflows/rotate-bdba-token.yml +++ b/.github/workflows/rotate-bdba-token.yml @@ -27,13 +27,10 @@ jobs: run: | # Generate new token from the Black Duck Binary Analysis API # Using the validity period of 3024000 seconds (35 days) - RESPONSE=$(curl -s -X POST \ + if ! RESPONSE=$(curl -sf -X POST \ -H "Authorization: Bearer ${{ secrets.BDBA_API_TOKEN }}" \ -d '{"validity": 3024000}' \ - "https://bdba.tools.sap/api/key/") - - # Check for curl errors - if [ $? -ne 0 ]; then + "https://bdba.tools.sap/api/key/"); then echo "::error::Failed to connect to BDBA API" exit 1 fi