Skip to content
Release pipeline

Release pipeline #152

Sign in to view logs

Release pipeline

Release pipeline #152

Workflow file for this run

.github/workflows/release.yaml at fb7bf2a
name: Release pipeline
on:
push:
# only for version 2.x.x releases and release candidates
tags:
- v2.?.?
- v2.?.?-RC?
workflow_dispatch:
env:
# threatdragon is the working area on docker hub so use this area
# owasp/threat-dragon is the final release area so DO NOT use that
IMAGE_NAME: threatdragon/owasp-threat-dragon
# for security reasons the github actions are pinned to specific release versions
jobs:
site_unit_tests:
name: Site unit tests
runs-on: ubuntu-24.04
defaults:
run:
working-directory: td.vue
steps:
- name: Checkout
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install packages
run: npm clean-install
- name: lint
run: npm run lint
- name: Unit test
run: npm run test:unit
server_unit_tests:
name: Server unit tests
runs-on: ubuntu-24.04
defaults:
run:
working-directory: td.server
steps:
- name: Checkout
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install packages
run: npm clean-install
- name: lint
run: npm run lint
- name: Unit test
run: npm run test:unit
- name: Create server SBOM
run: npm run make-sbom
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms-server
path: './td.server/sbom.*'
include-hidden-files: true
desktop_unit_tests:
name: Desktop unit tests
runs-on: ubuntu-24.04
defaults:
run:
working-directory: td.vue
steps:
- name: Checkout
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install packages
run: npm clean-install
- name: lint
run: npm run lint:desktop
- name: Unit test
run: npm run test:desktop
desktop_windows:
# Build only Windows installer and provide to github Release Draft
name: Windows installer
runs-on: windows-latest
needs: [desktop_unit_tests, site_unit_tests]
defaults:
run:
working-directory: td.vue
steps:
- name: Check out
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install clean packages
run: npm clean-install
- name: Build Windows executable
# code signing done later using Extended Verification (EV) with a hardware key
run: npm run build:desktop -- --windows --publish never
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms-desktop-windows-site
path: './td.vue/dist-desktop/bundled/.sbom/*'
include-hidden-files: true
if-no-files-found: error
desktop_macos:
# Build and publish MacOS installer to github Release Draft
# the draft name uses version and is created if it does not already exist
name: MacOS installer
runs-on: macos-latest
needs: [desktop_unit_tests, site_unit_tests]
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# MacOS signing: certificate and password, see electron.build/code-signing
CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
CSC_LINK: ${{ secrets.MAC_CERTS }}
# MacOS notarization: see github.com/electron/notarize#readme
APPLE_ID: ${{ secrets.APPLE_ID }}
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
defaults:
run:
working-directory: td.vue
steps:
- name: Check out
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install clean packages
run: npm clean-install
- name: Publish MacOS disk image
run: npm run build:desktop -- --mac --publish always
- name: Print logs on error
if: ${{ failure() }}
run: find . -name "*.log" -exec cat '{}' \; -print
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms-desktop-macos-site
path: './td.vue/dist-desktop/bundled/.sbom/*'
include-hidden-files: true
if-no-files-found: error
desktop_linux:
name: Linux installers
runs-on: ubuntu-24.04
needs: [desktop_unit_tests, site_unit_tests]
defaults:
run:
working-directory: td.vue
steps:
- name: Check out
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install clean packages
run: npm clean-install
# Build and publish Linux installers to github Release Draft
# for all linux images EXCEPT for the snap
# Snaps do not publish, even with snapcraft installed, so use Snap Store
- name: Publish Linux app images
shell: bash
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: npm run build:desktop -- --linux AppImage deb rpm --publish always
- name: Print logs on error
if: ${{ failure() }}
run: find . -name "*.log" -exec cat '{}' \; -print
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms-desktop-linux-site
path: './td.vue/dist-desktop/bundled/.sbom/*'
include-hidden-files: true
if-no-files-found: error
desktop_linux_snap:
name: Linux snap
runs-on: ubuntu-24.04
needs: [desktop_unit_tests, site_unit_tests]
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }}
defaults:
run:
working-directory: td.vue
steps:
- name: Check out
uses: actions/[email protected]
- name: Use node LTS 20.14.0
uses: actions/[email protected]
with:
node-version: '20.14.0'
- name: Cache NPM dir
uses: actions/[email protected]
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
${{ runner.os }}-
- name: Install clean packages
run: |
sudo snap install snapcraft --classic
npm clean-install
# Build the snap, but do not use inbuilt publish
# Snaps do not publish, even with snapcraft installed, so use Snap Store
- name: Build Linux snap
shell: bash
run: npm run build:desktop -- --linux snap
- name: Upload to Snap Store
shell: bash
run: snapcraft upload --release=stable dist-desktop/threat-dragon*.snap
- name: Print logs on error
if: ${{ failure() }}
run: find . -name "*.log" -exec cat '{}' \; -print
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms-desktop-linux-snap-site
path: './td.vue/dist-desktop/bundled/.sbom/*'
include-hidden-files: true
if-no-files-found: error
dockerhub_release:
name: Publish to dockerhub
runs-on: ubuntu-24.04
needs: [server_unit_tests, site_unit_tests]
steps:
- name: Checkout
uses: actions/[email protected]
- name: Set up QEMU
uses: docker/[email protected]
- name: Set up Docker Buildx
id: buildx
uses: docker/[email protected]
with:
install: true
- name: Cache Docker layers
uses: actions/[email protected]
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-${{ hashFiles('Dockerfile') }}
restore-keys: |
${{ runner.os }}-buildx-
${{ runner.os }}-
- name: Login to Docker Hub
uses: docker/[email protected]
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
# platform manifests not (yet) supported, so split out architectures
- name: Build for amd64 and push to Docker Hub
id: docker_build_amd64
uses: docker/[email protected]
with:
context: ./
file: ./Dockerfile
builder: ${{ steps.buildx.outputs.name }}
push: ${{ startsWith(github.ref, 'refs/tags/v') }}
tags: ${{ env.IMAGE_NAME }}:${{ github.ref_name }},${{ env.IMAGE_NAME }}:stable
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache,mode=max
platforms: linux/amd64
load: true
- name: Build for arm64 and push to Docker Hub
id: docker_build_arm64
uses: docker/[email protected]
with:
context: ./
file: ./Dockerfile
builder: ${{ steps.buildx.outputs.name }}
push: ${{ startsWith(github.ref, 'refs/tags/v') }}
tags: ${{ env.IMAGE_NAME }}:${{ github.ref_name }}-arm64
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
platforms: linux/arm64
load: true
- name: fetch app SBOM
run: docker run --rm --entrypoint tar "$IMAGE_ID" -c boms | tar -xv
env:
IMAGE_ID: ${{ steps.docker_build_amd64.outputs.imageid }}
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms-container-image-app
path: './boms/*'
include-hidden-files: true
if-no-files-found: error
- # Temp fix for large cache bug
# https://github.com/docker/build-push-action/issues/252
name: Move cache
run: |
rm -rf /tmp/.buildx-cache
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
sbom_combiner:
name: SBOM combiner
runs-on: ubuntu-24.04
needs:
- server_unit_tests
- desktop_macos
- desktop_linux
- desktop_linux_snap
- desktop_windows
- dockerhub_release
steps:
- name: Fetch prepared SBOM artifacts
uses: actions/[email protected]
with:
pattern: 'sboms-*'
merge-multiple: false
path: 'raw/'
- name: Fetch SBOMs
run: |
set -eux
mkdir -p sboms/threat-dragon-container-image/app/
cp raw/sboms-server/sbom.json sboms/threat-dragon-server-bom.json
cp raw/sboms-server/sbom.xml sboms/threat-dragon-server-bom.xml
cp raw/sboms-desktop-windows-site/bom.json sboms/threat-dragon-desktop-windows-site-bom.json
cp raw/sboms-desktop-windows-site/bom.xml sboms/threat-dragon-desktop-windows-site-bom.xml
cp raw/sboms-desktop-macos-site/bom.json sboms/threat-dragon-desktop-macos-site-bom.json
cp raw/sboms-desktop-macos-site/bom.xml sboms/threat-dragon-desktop-macos-site-bom.xml
cp raw/sboms-desktop-linux-site/bom.json sboms/threat-dragon-desktop-linux-site-bom.json
cp raw/sboms-desktop-linux-site/bom.xml sboms/threat-dragon-desktop-linux-site-bom.xml
cp raw/sboms-desktop-linux-snap-site/bom.json sboms/threat-dragon-desktop-linux-snap-site-bom.json
cp raw/sboms-desktop-linux-snap-site/bom.xml sboms/threat-dragon-desktop-linux-snap-site-bom.xml
cp raw/sboms-container-image-app/* sboms/threat-dragon-container-image/app/
- name: Save SBOM artifact
uses: actions/[email protected]
with:
name: sboms
path: 'sboms/'
include-hidden-files: true
webapp_release:
name: Publish web application
runs-on: ubuntu-24.04
needs:
- desktop_macos
- desktop_linux
- desktop_windows
- sbom_combiner
steps:
- name: Check out
uses: actions/[email protected]
- name: Fetch prepared SBOM artifacts
uses: actions/[email protected]
with:
name: 'sboms'
path: 'sboms/'
- name: Prepare release notes
run: |
releaseVersion=${{ github.ref_name }}
sed -e s/2.x.x/${releaseVersion:1}/g .release-note-template.md > ./release-notes.txt
tar -czvf threat-dragon-sboms.zip sboms
- name: Create release notes
uses: softprops/[email protected]
with:
draft: true
name: "${releaseVersion:1}"
append_body: true
body_path: ./release-notes.txt
generate_release_notes: true
files: |
threat-dragon-sboms.zip