diff --git a/.github/workflows/dependencyReport.yml b/.github/workflows/dependencyReport.yml index fedc61ba..63b654b8 100644 --- a/.github/workflows/dependencyReport.yml +++ b/.github/workflows/dependencyReport.yml @@ -1,5 +1,10 @@ name: Submit dependencies -on: push +on: + push: + branches: + - main +permissions: + contents: write jobs: library: runs-on: ubuntu-22.04 @@ -10,5 +15,23 @@ jobs: distribution: temurin java-version: 17 cache: gradle - - run: .scripts/dependency_report_generate.sh -m library -c allSourceSetsCompileDependenciesMetadata -o dependencies_library_raw - - run: echo "SCANNED_AT=$(TZ=UTC date +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_ENV + - run: .scripts/dependency_report_generate.sh -m library -c allSourceSetsCompileDependenciesMetadata > dependencies_library_raw + - run: .scripts/github/dependency_report_as_github_json.sh -i dependencies_library_raw -n library -s $(TZ=UTC date +"%Y-%m-%dT%H:%M:%SZ") > dependencies_library.github.json + - run: | + echo RESPONSE_CODE=$(curl -L \ + -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + https://api.github.com/repos/$GITHUB_REPOSITORY/dependency-graph/snapshots \ + --data-binary "@dependencies_library.github.json" \ + -o /dev/null \ + -w '%{http_code}') >> $GITHUB_ENV + - run: | + if [[ "$RESPONSE_CODE" == "201" ]]; + then + exit 0 + else + echo "Dependency submission failed with HTTP code $RESPONSE_CODE" + exit 1 + fi diff --git a/.scripts/dependency_report_generate.sh b/.scripts/dependency_report_generate.sh index 2c7124dd..d4147cc2 100755 --- a/.scripts/dependency_report_generate.sh +++ b/.scripts/dependency_report_generate.sh @@ -7,22 +7,29 @@ mkdir -p $DIR_TMP print_usage() { - echo "Usage: $0 -m -c -o " + echo "Usage: $0 -m -c " } -while getopts ":m:c:o:" OPT; do +while getopts ":m:c:" OPT; do case $OPT in m) MODULE="$OPTARG" ;; c) CONFIGURATION="$OPTARG" ;; - o) FILE_OUTPUT="$OPTARG" - ;; ?) print_usage exit 1 ;; esac done +if [ -z "${MODULE+x}" ]; then + print_usage + exit 1 +fi +if [ -z "${CONFIGURATION+x}" ]; then + print_usage + exit 1 +fi + read -r -d '' -a WITH_ADJUSTED < <(./gradlew --console=plain "$MODULE":dependencies --configuration "$CONFIGURATION" | grep --color=never -o "\S*:.*:.*" | grep --color=never -v "/" | awk 'NR > 1' | tr -d " (*)" && printf '\0' ) @@ -41,4 +48,4 @@ for DEPENDENCY in "${RESOLVED[@]}" do echo "$DEPENDENCY" >> $FILE_TMP done -sort -u $FILE_TMP > "$FILE_OUTPUT" +sort -u $FILE_TMP diff --git a/.scripts/github/dependency_report_as_github_json.sh b/.scripts/github/dependency_report_as_github_json.sh new file mode 100755 index 00000000..2794a747 --- /dev/null +++ b/.scripts/github/dependency_report_as_github_json.sh @@ -0,0 +1,82 @@ +#!/bin/bash +set -e + +DIR_TMP="build/report_dependencies_github_json" +rm -rf $DIR_TMP || true +mkdir -p $DIR_TMP + +print_usage() +{ + echo "Usage: $0 -i -n -s " +} + +while getopts ":i:n:s:" OPT; do + case $OPT in + i) INPUT_FILE="$OPTARG" + ;; + n) MANIFEST_NAME="$OPTARG" + ;; + s) SCANNED_AT="$OPTARG" + ;; + ?) print_usage + exit 1 + ;; + esac +done +if [ -z "${INPUT_FILE+x}" ]; then + print_usage + exit 1 +fi +if [ -z "${MANIFEST_NAME+x}" ]; then + print_usage + exit 1 +fi +if [ -z "${SCANNED_AT+x}" ]; then + print_usage + exit 1 +fi + +JSON=$(jq --null-input \ +--argjson VERSION 1 \ +--arg SHA "$GITHUB_SHA" \ +--arg REF "$GITHUB_REF" \ +--arg CORRELATOR "$GITHUB_WORKFLOW"_"$GITHUB_JOB" \ +--arg RUN_ID "$GITHUB_RUN_ID" \ +--arg HTML_URL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \ +--arg DETECTOR_NAME "$GITHUB_REPOSITORY" \ +--arg DETECTOR_VERSION 1 \ +--arg DETECTOR_URL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \ +--arg SCANNED "$SCANNED_AT" \ +--arg MANIFEST_NAME "$MANIFEST_NAME" \ +' +{ + "version":$VERSION, + "sha":$SHA, + "ref":$REF, + "job":{ + "correlator":$CORRELATOR, + "id":$RUN_ID, + "html_url":$HTML_URL + }, + "detector":{ + "name":$DETECTOR_NAME, + "version":$DETECTOR_VERSION, + "url":$DETECTOR_URL + }, + "scanned":$SCANNED, + "manifests":{ + ($MANIFEST_NAME):{ + "name":$MANIFEST_NAME, + "resolved":{ + } + } + } +} +') + +for LINE in $(cat $INPUT_FILE) +do + JSON=$(jq '.manifests.'$MANIFEST_NAME'.resolved += {"'$LINE'": {}}' <<< $JSON) +done + +jq -r tostring <<< $JSON