feat(soup-sbom): optional mobile-artifact input for products with a mobile build - #57
Closed
KlausNie wants to merge 1 commit into
Closed
feat(soup-sbom): optional mobile-artifact input for products with a mobile build#57KlausNie wants to merge 1 commit into
KlausNie wants to merge 1 commit into
Conversation
…obile build Without this, a product needing to hand a built APK/AAB to soup-discovery (SBOM_ARTIFACT_<id>) had to inline this workflow's own steps in its caller just to add one step in between, and silently drifts from this file afterwards - e.g. it would have missed the JDK/Maven step added here. mobile-artifact: "<candidate-id>:<release-asset-glob>" downloads the matching release asset for the run's version, extracts it, and exports SBOM_ARTIFACT_<candidate-id> before the scan. No match is recorded as a named gap, same as leaving the input unset - consistent with how the rest of this pipeline treats an unscannable in-scope candidate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A product with a mobile build needs to hand its built APK/AAB to
soup-discovery(SBOM_ARTIFACT_<id>), since the pipeline can't produce that artifact itself. Today the only way to do that is to inline this whole workflow's steps in the caller (checkout, ensure-gh, the discovery action) just to insert one fetch step in between — a job that calls a reusable workflow can't also have its own steps, and env vars don't cross into a separately-invoked reusable workflow's job. That inlined copy then silently drifts from this file — concretely, it would have missed the JDK/Maven step added after it was written.mobile-artifactfixes this without duplicating anything:"<candidate-id>:<release-asset-glob>"downloads the matching release asset for the run's version, extracts it, and exportsSBOM_ARTIFACT_<candidate-id>before the scan. No match is a named gap, same as leaving the input unset — consistent with how the rest of this pipeline treats an unscannable in-scope candidate.Context
Surfaced while wiring osteocoach onto this tooling: QuickBirdEng/osteocoach#937.