feat: add build artifacts metadata for mtaBuild #5166

phgermanov · 2024-10-29T13:19:48Z

As part of HSPIPER-290 we need to add build artifacts for mta

D074360 · 2024-10-29T13:54:35Z

cmd/mtaBuild.go

@@ -563,3 +582,22 @@ func getAbsPath(path string) string {
 	}
 	return filepath.FromSlash(abspath)
 }
+
+func getPurl(mtaYaml string) string {


This part we have repeated in https://github.com/SAP/jenkins-library/blob/master/cmd/mavenBuild.go#L277 and https://github.com/SAP/jenkins-library/blob/master/pkg/npm/publish.go#L229

Can we move the logic to https://github.com/SAP/jenkins-library/blob/master/pkg/piperutils/cyclonedxBom.go

And use the same in all places?

4cf86a0 and 8faf232

D074360 · 2024-10-29T13:55:31Z

@phgermanov Is this change tested in a pipeline ?

D074360 · 2024-10-30T08:10:53Z

cmd/mavenBuild.go

@@ -255,7 +254,7 @@ func createBuildArtifactsMetadata(config *mavenBuildOptions, commonPipelineEnvir
 			} else {
 				coordinate.BuildPath = filepath.Dir(match)
 				coordinate.URL = config.AltDeploymentRepositoryURL
-				coordinate.PURL = getPurlForThePom(match)
+				coordinate.PURL = piperutils.GetPurl(match, mvnSimpleBomFilename+".xml")


The bom path is wrong. For maven the bom will be inside target folder

relativeBomPath := filepath.Join("/target/" + mvnSimpleBomFilename + ".xml")
coordinate.PURL = piperutils.GetPurl(match, relativeBomPath)

Yep, I think that was the issue with the failing tests

D074360 · 2024-10-30T08:26:43Z

pkg/piperutils/cyclonedxBom.go

@@ -46,3 +48,22 @@ func GetBom(absoluteBomPath string) (Bom, error) {
 	}
 	return bom, nil
 }
+
+func GetPurl(filePath, bomFilename string) string {


This function definition is misleading as, we don't send "filePath" to BOM. We send filePath to package manager like pom.xml or package.json.

Can we simplify in a way that, we only send file path to BOM and get back purl ?

Or rename function definition to

GetPurl(filePathToPackageManager, relativeBomFilePath)

D074360 · 2024-10-30T12:05:14Z

cmd/mtaBuild.go

+				Packaging:  "mtar",
+				BuildPath:  filepath.Dir(mtarPath),
+				URL:        config.MtaDeploymentRepositoryURL,
+				PURL:       piperutils.GetPurl(filepath.Join(mtarPath, "sbom-gen/bom-mta.xml")),


This should be

PURL: piperutils.GetPurl(filepath.Join(filepath.Dir(mtarPath), "sbom-gen/bom-mta.xml"))

pkg/npm/publish.go

cmd/mavenBuild.go

Co-authored-by: Manjunath <[email protected]>

D074360 · 2024-10-31T10:35:48Z

cmd/mtaBuild.go

-				credentialsEncoded := "Basic " + base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", config.MtaDeploymentRepositoryUser, config.MtaDeploymentRepositoryPassword)))
-				headers := http.Header{}
-				headers.Add("Authorization", credentialsEncoded)
+		if err = handlePublish(config, commonPipelineEnvironment, utils, mtarName, isMtarNativelySuffixed); err != nil {


Maybe we can keep this log

log.Entry().Infof("publish detected")

D074360 · 2024-10-31T10:45:21Z

cmd/mtaBuild.go

+				ArtifactID: config.MtarName,
+				Version:    config.Version,
+				Packaging:  "mtar",
+				BuildPath:  mtarDir,


The build path should be path of mta.yaml file and not the mtar. Is mtar generated at the same directory as of mta.yaml? or users can choose to change the path?

sonarqubecloud · 2024-11-01T11:00:51Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

D074360

LGTM

D074360 · 2024-11-04T07:50:46Z

/it-go

…ix-fix * origin/master: (43 commits) fix handle new naming strategy for Central Build stage name if extension is used (SAP#5178) Remove commit message from project-metadata.toml (SAP#5176) handle new naming strategy for Central Build stage name (SAP#5171) Update URL to current SapMachine (SAP#5126) checkmarxOneExecuteScan - Fix report generation in CxOne 3.20 (SAP#5170) docs: update pr template to include inner source update reminder (SAP#5169) handle error while fetching working directory (SAP#5168) Final round of adding quoting to prevent command injection (SAP#5167) feat: add build artifacts metadata for mtaBuild (SAP#5166) Fix more potential command injection via quoting (SAP#5164) Add identifier data to create uuid in events (SAP#5165) Update version of org.cyclonedx:cyclonedx-maven-plugin (SAP#5156) Fix: validate app name (SAP#5155) fix: command injection vulnerability (SAP#5161) fix deadlock and add more logging (SAP#5160) fix(sonar): allign groovy part of Sonar step with common piperExecuteBin (SAP#5157) modify logging (SAP#5158) Detect script version 9 (SAP#5154) feat(vault): not allowing batch token revoke (SAP#4918) refactor(vault): Refactor vault package (SAP#5148) ...

* origin/master: (43 commits) fix handle new naming strategy for Central Build stage name if extension is used (SAP#5178) Remove commit message from project-metadata.toml (SAP#5176) handle new naming strategy for Central Build stage name (SAP#5171) Update URL to current SapMachine (SAP#5126) checkmarxOneExecuteScan - Fix report generation in CxOne 3.20 (SAP#5170) docs: update pr template to include inner source update reminder (SAP#5169) handle error while fetching working directory (SAP#5168) Final round of adding quoting to prevent command injection (SAP#5167) feat: add build artifacts metadata for mtaBuild (SAP#5166) Fix more potential command injection via quoting (SAP#5164) Add identifier data to create uuid in events (SAP#5165) Update version of org.cyclonedx:cyclonedx-maven-plugin (SAP#5156) Fix: validate app name (SAP#5155) fix: command injection vulnerability (SAP#5161) fix deadlock and add more logging (SAP#5160) fix(sonar): allign groovy part of Sonar step with common piperExecuteBin (SAP#5157) modify logging (SAP#5158) Detect script version 9 (SAP#5154) feat(vault): not allowing batch token revoke (SAP#4918) refactor(vault): Refactor vault package (SAP#5148) ...

…fig-fix * origin/master: (43 commits) fix handle new naming strategy for Central Build stage name if extension is used (SAP#5178) Remove commit message from project-metadata.toml (SAP#5176) handle new naming strategy for Central Build stage name (SAP#5171) Update URL to current SapMachine (SAP#5126) checkmarxOneExecuteScan - Fix report generation in CxOne 3.20 (SAP#5170) docs: update pr template to include inner source update reminder (SAP#5169) handle error while fetching working directory (SAP#5168) Final round of adding quoting to prevent command injection (SAP#5167) feat: add build artifacts metadata for mtaBuild (SAP#5166) Fix more potential command injection via quoting (SAP#5164) Add identifier data to create uuid in events (SAP#5165) Update version of org.cyclonedx:cyclonedx-maven-plugin (SAP#5156) Fix: validate app name (SAP#5155) fix: command injection vulnerability (SAP#5161) fix deadlock and add more logging (SAP#5160) fix(sonar): allign groovy part of Sonar step with common piperExecuteBin (SAP#5157) modify logging (SAP#5158) Detect script version 9 (SAP#5154) feat(vault): not allowing batch token revoke (SAP#4918) refactor(vault): Refactor vault package (SAP#5148) ...

feat: add build artifacts metadata

4227d23

phgermanov requested a review from a team as a code owner October 29, 2024 13:19

phgermanov and others added 2 commits October 29, 2024 15:26

Merge branch 'master' into phgermanov/mta-build-artifacts-metadata

85796f8

test: default to error for mock

e64ac61

D074360 changed the title ~~feat: add build artifacts metadata~~ feat: add build artifacts metadata for mtaBuild Oct 29, 2024

D074360 reviewed Oct 29, 2024

View reviewed changes

Philip Germanov added 4 commits October 29, 2024 16:12

refactor: extsact getPurl in piper utils

4cf86a0

test: fix getPurl tests

8faf232

test: fix mavenBuild getPurl tests

f1df2c1

test: remove testPurl from mavenBuild

b41f987

D074360 reviewed Oct 30, 2024

View reviewed changes

fix: get purl arguments

201a9fa

D074360 reviewed Oct 30, 2024

View reviewed changes

pkg/npm/publish.go Outdated Show resolved Hide resolved

D074360 reviewed Oct 30, 2024

View reviewed changes

cmd/mavenBuild.go Outdated Show resolved Hide resolved

phgermanov and others added 4 commits October 30, 2024 14:10

Update pkg/npm/publish.go

63b800b

Co-authored-by: Manjunath <[email protected]>

Update cmd/mavenBuild.go

9041bd1

Co-authored-by: Manjunath <[email protected]>

fix: update bom path

f5e26cf

Merge branch 'master' into phgermanov/mta-build-artifacts-metadata

7d4e70c

D074360 reviewed Oct 31, 2024

View reviewed changes

Philip Germanov added 2 commits November 1, 2024 13:00

fix: add back removed log

b988bbd

fix: use mta.yaml path for BuildPath

318a082

D074360 approved these changes Nov 4, 2024

View reviewed changes

phgermanov merged commit 6988f43 into master Nov 4, 2024
12 checks passed

phgermanov deleted the phgermanov/mta-build-artifacts-metadata branch November 4, 2024 10:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add build artifacts metadata for mtaBuild #5166

feat: add build artifacts metadata for mtaBuild #5166

phgermanov commented Oct 29, 2024

D074360 Oct 29, 2024

phgermanov Oct 29, 2024 •

edited

Loading

D074360 commented Oct 29, 2024

D074360 Oct 30, 2024 •

edited

Loading

phgermanov Oct 30, 2024

phgermanov Oct 30, 2024

D074360 Oct 30, 2024 •

edited

Loading

phgermanov Oct 30, 2024

D074360 Oct 30, 2024

phgermanov Oct 30, 2024

D074360 Oct 31, 2024

phgermanov Nov 1, 2024

D074360 Oct 31, 2024

phgermanov Nov 1, 2024

sonarqubecloud bot commented Nov 1, 2024

D074360 left a comment

D074360 commented Nov 4, 2024

feat: add build artifacts metadata for mtaBuild #5166

feat: add build artifacts metadata for mtaBuild #5166

Conversation

phgermanov commented Oct 29, 2024

Choose a reason for hiding this comment

phgermanov Oct 29, 2024 • edited Loading

Choose a reason for hiding this comment

D074360 commented Oct 29, 2024

D074360 Oct 30, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

D074360 Oct 30, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Nov 1, 2024

Quality Gate passed

D074360 left a comment

Choose a reason for hiding this comment

D074360 commented Nov 4, 2024

phgermanov Oct 29, 2024 •

edited

Loading

D074360 Oct 30, 2024 •

edited

Loading

D074360 Oct 30, 2024 •

edited

Loading