Create regenerate-all-sboms.yml

Author: swmal

.github/workflows/regenerate-all-sboms.yml

@@ -0,0 +1,128 @@
+# Regenerates all SBOMs for all published EPPlus versions using specVersion 1.6.
+# Triggered manually via workflow_dispatch.
+name: Regenerate All SBOMs
+
+on:
+  workflow_dispatch:
+
+jobs:
+  sbom:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        version:
+          - 7.3.0
+          - 7.3.1
+          - 7.3.2
+          - 7.4.0
+          - 7.4.1
+          - 7.4.2
+          - 7.5.0
+          - 7.5.1
+          - 7.5.2
+          - 7.5.3
+          - 7.6.0
+          - 7.6.1
+          - 7.7.0
+          - 7.7.1
+          - 7.7.2
+          - 7.7.3
+          - 8.0.1
+          - 8.0.2
+          - 8.0.3
+          - 8.0.4
+          - 8.0.5
+          - 8.0.6
+          - 8.0.7
+          - 8.0.8
+          - 8.1.0
+          - 8.1.1
+          - 8.2.0
+          - 8.2.1
+          - 8.3.0
+          - 8.3.1
+          - 8.4.0
+          - 8.4.1
+          - 8.4.2
+          - 8.5.0
+      # Allow other versions to continue if one fails
+      fail-fast: false
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: release/epplus${{ matrix.version }}
+
+    - name: Fetch sbom-metadata-template.xml from develop8
+      run: |
+        git fetch origin develop8
+        git checkout origin/develop8 -- src/EPPlus/sbom-metadata-template.xml
+      shell: pwsh
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: |
+          9.0.x
+          10.0.x
+
+    - name: Read target frameworks from csproj
+      run: |
+        $xml = [xml](Get-Content ./src/EPPlus/EPPlus.csproj)
+        $tfms = $xml.Project.PropertyGroup.TargetFrameworks | Where-Object { $_ } | Select-Object -First 1
+        echo "VERSION=${{ matrix.version }}" >> $env:GITHUB_ENV
+        echo "TFMS=$tfms" >> $env:GITHUB_ENV
+      shell: pwsh
+
+    - name: Restore dependencies
+      run: dotnet restore ./src/EPPlus.sln
+
+    - name: Install CycloneDX
+      run: dotnet tool install --global CycloneDX
+
+    - name: Generate combined SBOM
+      run: dotnet CycloneDX ./src/EPPlus/EPPlus.csproj -o ./sbom -F Json -st Library -sv ${{ env.VERSION }} -fn epplus-${{ env.VERSION }}.sbom.json -imp ./src/EPPlus/sbom-metadata-template.xml --spec-version 1.6
+
+    - name: Generate per-TFM SBOMs
+      run: |
+        $tfms = "${{ env.TFMS }}" -split ";"
+        foreach ($tfm in $tfms) {
+          $tfm = $tfm.Trim()
+          if ([string]::IsNullOrEmpty($tfm)) { continue }
+          Write-Host "Generating SBOM for $tfm"
+          dotnet CycloneDX ./src/EPPlus/EPPlus.csproj -o ./sbom -F Json -st Library -sv ${{ env.VERSION }} -fn "epplus-${{ env.VERSION }}.$tfm.sbom.json" -imp ./src/EPPlus/sbom-metadata-template.xml --framework $tfm --spec-version 1.6
+        }
+      shell: pwsh
+
+    - name: Generate SHA-256 checksums for all SBOMs
+      run: |
+        Get-ChildItem -Path "./sbom" -Filter "*.sbom.json" | ForEach-Object {
+          $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
+          "$hash  $($_.Name)" | Out-File -FilePath "$($_.FullName).sha256" -Encoding utf8NoBOM
+          Write-Host "Checksum generated for $($_.Name): $hash"
+        }
+      shell: pwsh
+
+    - name: Authenticate to Azure
+      uses: Azure/login@v2
+      with:
+        creds: '{"clientId":"${{ secrets.EPPLUS_CODE_SIGNING_APPLICATION_ID }}","clientSecret":"${{ secrets.EPPLUS_CODE_SIGNING_SECRET }}","subscriptionId":"${{ secrets.EPPLUS_CODE_SIGNING_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.EPPLUS_CODE_SIGNING_TENENT_ID }}"}'
+
+    - name: Upload all SBOMs to Azure Blob Storage
+      run: |
+        Get-ChildItem -Path "./sbom" | ForEach-Object {
+          Write-Host "Uploading $($_.Name)"
+          az storage blob upload `
+            --account-name eppluswebprod `
+            --container-name sbom `
+            --name $_.Name `
+            --file $_.FullName `
+            --auth-mode login `
+            --overwrite
+        }
+      shell: pwsh
+
+    - name: Upload all SBOMs as artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: sbom-${{ matrix.version }}
+        path: ./sbom/