Save / Publish SBOMs to GitHub Packages by mpreyskurantov · Pull Request #33757 · DevExpress/DevExtreme

mpreyskurantov · 2026-05-28T11:02:02Z

No description provided.

…al-dev

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

…al-dev

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Signed-off-by: Mikhail Preyskurantov <5574159+mpreyskurantov@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

…al-dev

This reverts commit 0da90d6.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

+          shopt -s nullglob
+          sbom_files=(packages/sbom/dist/*.sbom.json)
+


+          # if [ ! -f "$SBOM_FILE" ]; then
+          #   echo "No SBOM found for $UNSCOPED_PACKAGE_NAME"
+          #   echo "hasSbom=false" >> "$GITHUB_OUTPUT";
+          #   exit 0;
+          # fi


Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

+        shell: bash
+        run: |
+          shopt -s nullglob
+          sbom_files=(packages/sbom/dist/*.sbom.json)


…al-dev

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

+        run: |
+          shopt -s nullglob
+          sbom_files=(packages/sbom/dist/*.sbom.json)
+


+          mkdir -p "$SBOM_PACKAGE_DIR" "$SBOM_TGZ_DIR";
+          cp "$SBOM_FILE" "$SBOM_PACKAGE_DIR/";
+          cd "$SBOM_PACKAGE_DIR";
+          node -e "const fs = require('fs'); const [name, version, license, author] = process.argv.slice(1); fs.writeFileSync('package.json', JSON.stringify({ name, version, license, author }, null, 2));" "$SBOM_PACKAGE_NAME" "$PACKAGE_VERSION" "$PACKAGE_LICENSE" "$PACKAGE_AUTHOR";


…al-dev

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

+        shell: bash
+        run: |
+          shopt -s nullglob
+          sbom_files=(packages/sbom/dist/*.sbom.json)


+          SCOPE=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]');
+          SBOM_PACKAGE_NAME="$UNSCOPED_PACKAGE_NAME-sbom";
+          SBOM_PACKAGE_DIR="sbom-package/$SBOM_PACKAGE_NAME";
+          SBOM_TGZ_DIR="sbom-package-tgz";
+          PACKAGE_LICENSE=$(node -p "require('./package.json').license");
+          PACKAGE_AUTHOR=$(node -p "require('./package.json').author");


…active policies reject

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

packages/sbom/pnpm-lock.yaml: Generated file

+          shopt -s nullglob
+          sbom_files=(packages/sbom/dist/*.sbom.json)
+


cyclonedx cli validate sbom

ebb1509

mpreyskurantov self-assigned this May 28, 2026

Copilot AI review requested due to automatic review settings May 28, 2026 11:02

mpreyskurantov requested a review from a team as a code owner May 28, 2026 11:02

mpreyskurantov added the 26_1 label May 28, 2026

Copilot started reviewing on behalf of mpreyskurantov May 28, 2026 11:02 View session

This comment was marked as outdated.

Sign in to view

mpreyskurantov added 2 commits June 3, 2026 19:04

sha256sum / checksum

5411141

Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…

e2aab28

…al-dev

Copilot AI review requested due to automatic review settings June 4, 2026 14:56

Copilot started reviewing on behalf of mpreyskurantov June 4, 2026 14:57 View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

mpreyskurantov added 2 commits June 5, 2026 14:13

Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…

16d2046

…al-dev

CYCLONEDX_CLI: WIN -> LINUX (after #33854)

73369e3

Copilot AI review requested due to automatic review settings June 5, 2026 11:43

Copilot started reviewing on behalf of mpreyskurantov June 5, 2026 11:43 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

Comment thread .github/workflows/packages_publishing.yml Outdated

mpreyskurantov added 3 commits June 5, 2026 15:07

CYCLONEDX_CLI: WIN -> LINUX, v2, exe || true (after #33854)

76ef292

Signed-off-by: Mikhail Preyskurantov <5574159+mpreyskurantov@users.noreply.github.com>

SBOM package(s) flow (like for NPM package(s))

aaffe18

SBOM package(s) optimized flow only (no NPM package(s))

0da90d6

Copilot AI review requested due to automatic review settings June 5, 2026 16:01

Copilot started reviewing on behalf of mpreyskurantov June 5, 2026 16:01 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

Comment thread .github/workflows/packages_publishing.yml

Comment thread .github/workflows/packages_publishing.yml Outdated

Comment thread .github/workflows/packages_publishing.yml Outdated

mpreyskurantov added 4 commits June 8, 2026 17:41

revert "continue-on-error: true"

7614d05

Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…

935e8e2

…al-dev

Revert "SBOM package(s) optimized flow only (no NPM package(s))"

6cf243a

This reverts commit 0da90d6.

*.sbom.json -> *.cdx.json

eb2326f

Copilot AI review requested due to automatic review settings June 8, 2026 15:00

Copilot started reviewing on behalf of mpreyskurantov June 8, 2026 15:00 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

mpreyskurantov added 2 commits June 8, 2026 18:33

dx-make-sbom with hashes

525e50b

hasSbom for tgz

3ed1bf0

Copilot AI review requested due to automatic review settings June 8, 2026 16:02

Copilot started reviewing on behalf of mpreyskurantov June 8, 2026 16:02 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

mpreyskurantov added 2 commits June 9, 2026 16:07

build-hashed

5519d6c

Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…

b223804

…al-dev

Copilot AI review requested due to automatic review settings June 10, 2026 18:43

Copilot started reviewing on behalf of mpreyskurantov June 10, 2026 18:43 View session

Copilot AI reviewed Jun 10, 2026

View reviewed changes

mpreyskurantov added 4 commits June 10, 2026 22:12

validate via action

f036feb

Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…

d8cb985

…al-dev

Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…

c29251a

…al-dev

DevExpress/github-actions/validate-sbom + commit hash

8f9a65f

Copilot AI review requested due to automatic review settings June 17, 2026 15:14

Copilot started reviewing on behalf of mpreyskurantov June 17, 2026 15:15 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

mpreyskurantov added 2 commits June 21, 2026 14:39

publish scoped sboms instantly (without changing scope)

6bb3327

packages/sbom/pnpm-lock.yaml: the lockfile contains entries that the …

2212238

…active policies reject

Copilot AI review requested due to automatic review settings June 21, 2026 18:18

Copilot started reviewing on behalf of mpreyskurantov June 21, 2026 18:18 View session

Copilot AI reviewed Jun 21, 2026

View reviewed changes

Comment thread .github/workflows/build_all.yml

Comment on lines +89 to +91

shopt -s nullglob

sbom_files=(packages/sbom/dist/*.sbom.json)

mpreyskurantov changed the title ~~Validate SBOMs with CycloneDX CLI~~ Save / Publish SBOMs to GitHub Packages Jun 21, 2026

		shopt -s nullglob
		sbom_files=(packages/sbom/dist/*.sbom.json)

Conversation

mpreyskurantov commented May 28, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants