Skip to content

Add SBOM release metadata #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
krotname merged 1 commit into from
Jun 21, 2026
+54 −4
Merged

Add SBOM release metadata #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 28 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,8 @@ jobs:

- name: Generate release checksums
shell: bash
env:
VERSION: ${{ needs.version.outputs.version }}
run: |
mkdir -p release-files
mapfile -t downloaded_files < <(find release-assets -type f -name '*.zip' | sort)
Expand All @@ -136,15 +138,37 @@ jobs:
cp "$file" "release-files/$(basename "$file")"
done

mapfile -t files < <(find release-files -maxdepth 1 -type f -name '*.zip' | sort)
timestamp="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
cat > "release-files/MarkdownTableEditor-$VERSION-sbom.cdx.json" <<EOF
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"version": 1,
Comment on lines +143 to +146

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Include the CycloneDX serialNumber

After the SBOM path is made explicit, the generated CycloneDX document is still rejected by the same pinned actions/attest code: its CycloneDX detector requires bomFormat, serialNumber, and specVersion, but this JSON only emits bomFormat and specVersion. That makes the SBOM attestation fail with Unsupported SBOM format, blocking releases that use the new SBOM step.

Useful? React with 👍 / 👎.

"metadata": {
"timestamp": "$timestamp",
"component": {
"type": "application",
"name": "NppMarkdownTableEditor",
"version": "$VERSION",
"purl": "pkg:github/krotname/NppMarkdownTableEditor@v$VERSION"
}
}
}
EOF

mapfile -t files < <(find release-files -maxdepth 1 -type f \( -name '*.zip' -o -name '*-sbom.cdx.json' \) | sort)
sha256sum "${files[@]}" > SHA256SUMS.txt
cat SHA256SUMS.txt

- name: Generate release provenance attestation
continue-on-error: true
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
with:
subject-checksums: SHA256SUMS.txt
- name: Generate release SBOM attestation
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
with:
subject-path: release-files/*.zip
sbom-path: release-files/*-sbom.cdx.json

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use a concrete SBOM path for attestation

In the release job, this action input is not run through a shell, so the * is passed literally to actions/attest. I checked the pinned action: only subject-path is documented as accepting globs, while sbom-path is read directly with fs.stat(filePath), which will fail here with SBOM file not found because the generated file is named MarkdownTableEditor-$VERSION-sbom.cdx.json. Any release that reaches this step will fail before publishing.

Useful? React with 👍 / 👎.


- name: Publish GitHub release
shell: bash
Expand All @@ -153,7 +177,7 @@ jobs:
TAG_NAME: ${{ needs.version.outputs.tag }}
VERSION: ${{ needs.version.outputs.version }}
run: |
mapfile -t files < <(find release-files -maxdepth 1 -type f -name '*.zip' | sort)
mapfile -t files < <(find release-files -maxdepth 1 -type f \( -name '*.zip' -o -name '*-sbom.cdx.json' \) | sort)
if [ "${#files[@]}" -eq 0 ]; then
echo "No release ZIP files were downloaded." >&2
exit 1
Expand All @@ -163,7 +187,7 @@ jobs:

- Hardened GitHub Actions permissions, dependency review, CodeQL, Scorecard, release packaging, and remote-update checks after repository audit.
- Refreshed compatibility smoke scripts and packaging targets for the current Notepad++ plugin release baseline.
- Rebuilt x86, x64, and arm64 plugin ZIPs plus Plugin Admin ZIPs with SHA-256 sums.
- Rebuilt x86, x64, and arm64 plugin ZIPs plus Plugin Admin ZIPs with SHA-256 sums, SBOM, and GitHub attestations.

## Validation

Expand Down
10 changes: 10 additions & 0 deletions README.en.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,16 @@ If Windows does not allow writing to `Program Files`, install the plugin in the
%LOCALAPPDATA%\Notepad++\plugins\MarkdownTableEditor\MarkdownTableEditor.dll
```

## Release Verification

Each release publishes x86/x64/arm64 ZIP archives, Plugin Admin ZIPs,
`SHA256SUMS.txt`, CycloneDX SBOM, and GitHub attestations.

```bash
sha256sum -c SHA256SUMS.txt
gh attestation verify MarkdownTableEditor-*-x64.zip --repo krotname/NppMarkdownTableEditor
```

## Publication

- Official Notepad++ Plugin List pull request: https://github.com/notepad-plus-plus/nppPluginList/pull/1115
Expand Down
10 changes: 10 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,16 @@ C:\Program Files\Notepad++\plugins\MarkdownTableEditor\MarkdownTableEditor.dll
%LOCALAPPDATA%\Notepad++\plugins\MarkdownTableEditor\MarkdownTableEditor.dll
```

## Проверка Релиза

Каждый release публикует ZIP-архивы для x86/x64/arm64, Plugin Admin ZIP,
`SHA256SUMS.txt`, CycloneDX SBOM и GitHub attestations.

```bash
sha256sum -c SHA256SUMS.txt
gh attestation verify MarkdownTableEditor-*-x64.zip --repo krotname/NppMarkdownTableEditor
```

## Публикация

- PR в официальный Notepad++ Plugin List: https://github.com/notepad-plus-plus/nppPluginList/pull/1115
Expand Down
6 changes: 6 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,9 @@ Include:
- suggested mitigation if available.

The maintainer aims to acknowledge valid reports within 48 hours and provide a remediation timeline after the impact is confirmed.

## Supply-chain controls

- Release packages include architecture ZIPs, Plugin Admin ZIPs, `SHA256SUMS.txt`, CycloneDX SBOM, and GitHub attestations.
- GitHub Actions are pinned by immutable commit SHA.
- Dependency Review, CodeQL, Scorecard, and actionlint run as repository quality gates.
Loading