Skip to content

Commit b3b19ce

Browse files
Merge branch 'master' into feat/crypto-registry-shangmi-sm2-sm3-sm4-sm9
2 parents f21fcb0 + 992b950 commit b3b19ce

11 files changed

Lines changed: 336 additions & 23 deletions

File tree

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
name: Update SPDX licenses
2+
3+
on:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
workflow_dispatch:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
13+
permissions: { }
14+
15+
jobs:
16+
update:
17+
name: Update Schemas
18+
runs-on: ubuntu-latest
19+
outputs:
20+
changed: ${{ steps.diff.outputs.changed }}
21+
version: ${{ steps.version.outputs.version }}
22+
timeout-minutes: 10
23+
steps:
24+
- name: Checkout
25+
# see https://github.com/actions/checkout
26+
uses: actions/checkout@v5
27+
with:
28+
ref: ${{ github.ref_name }}
29+
- name: Set up JDK
30+
# see https://github.com/actions/setup-java
31+
uses: actions/setup-java@v5
32+
with:
33+
java-version: '21'
34+
distribution: 'zulu'
35+
java-package: jdk
36+
- name: Update SPDX
37+
run: tools/updateSpdx.sh
38+
- name: detect version
39+
id: version
40+
run: |
41+
value=$( jq -r '.["$comment"]' schema/spdx.schema.json )
42+
echo "version=$value" >> $GITHUB_OUTPUT
43+
- name: Detect changes
44+
id: diff
45+
run: |
46+
if git diff --quiet -- 'schema/spdx.*'
47+
then
48+
echo "$GITHUB_REF_NAME is up-to-date"
49+
echo "changed=false" >> $GITHUB_OUTPUT
50+
else
51+
echo "$GITHUB_REF_NAME is not up-to-date"
52+
echo "changed=true" >> $GITHUB_OUTPUT
53+
fi
54+
- name: Artifact changes
55+
if: ${{ steps.diff.outputs.changed == 'true' }}
56+
# https://github.com/actions/upload-artifact
57+
uses: actions/upload-artifact@v4
58+
with:
59+
retention-days: 1
60+
name: schema-spdx
61+
path: schema/spdx.*
62+
if-no-files-found: error
63+
pullrequest:
64+
name: Pull-request Changes
65+
runs-on: ubuntu-latest
66+
needs: [ 'update' ]
67+
if: ${{ needs.update.outputs.changed == 'true' }}
68+
permissions:
69+
contents: write # push commits
70+
pull-requests: write # create pullrequests
71+
env:
72+
SB_VERSION: ${{ needs.update.outputs.version }}
73+
SB_BRANCH: ${{ github.ref_name }}_update-spdx/${{ needs.update.outputs.version }}
74+
steps:
75+
- name: Checkout
76+
# see https://github.com/actions/checkout
77+
uses: actions/checkout@v5
78+
with:
79+
ref: ${{ github.ref_name }}
80+
- name: Switch branch
81+
id: branch
82+
run: |
83+
set -eux
84+
git remote set-branches origin "$SB_BRANCH"
85+
if git ls-remote --exit-code --heads origin "$SB_BRANCH"
86+
then
87+
echo "existed=true" >> $GITHUB_OUTPUT
88+
git fetch --depth=1 origin "$SB_BRANCH"
89+
git checkout -b "$SB_BRANCH" "origin/$SB_BRANCH"
90+
else
91+
echo "existed=false" >> $GITHUB_OUTPUT
92+
git checkout -b "$SB_BRANCH"
93+
fi
94+
- name: Fetch changes
95+
# https://github.com/actions/download-artifact
96+
uses: actions/download-artifact@v5
97+
with:
98+
name: schema-spdx
99+
path: schema
100+
- name: Commit and push
101+
run: |
102+
set -eux
103+
if git diff --quiet -- 'schema/spdx.*'
104+
then
105+
echo "branch up-to-date"
106+
exit 0
107+
fi
108+
git config user.name 'spdx-license-bumper[bot]'
109+
git config user.email 'spdx-license-bumper@bot.local'
110+
git add -A schema
111+
git commit -s -m "feat: bump SPDX licenses $SB_VERSION"
112+
git push origin "$SB_BRANCH"
113+
- name: Pull request
114+
if: ${{ steps.branch.outputs.existed == 'false' }}
115+
run: >
116+
gh pr create
117+
--title "feat: bump SPDX Licenses $SB_VERSION"
118+
--body "$SB_VERSION"
119+
--base "$GITHUB_REF_NAME"
120+
--head "$SB_BRANCH"
121+
env:
122+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

schema/bom-1.6.proto

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import "google/protobuf/timestamp.proto";
44

55
// Specifies attributes of the text
66
message AttachedText {
7-
// Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents. [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).
7+
// Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents. [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).
88
optional string content_type = 1;
99
// Specifies the optional encoding the text is represented in
1010
optional string encoding = 2;
@@ -888,7 +888,7 @@ message Vulnerability {
888888
optional Source source = 3;
889889
// Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Oftentimes, the same vulnerability may exist in multiple sources of vulnerability intelligence but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.
890890
repeated VulnerabilityReference references = 4;
891-
// List of vulnerability ratings
891+
// List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.
892892
repeated VulnerabilityRating ratings = 5;
893893
// List of Common Weaknesses Enumerations (CWEs) codes that describe this vulnerability. For example, 399 (of https://cwe.mitre.org/data/definitions/399.html)
894894
repeated int32 cwes = 6;

schema/bom-1.6.schema.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2681,7 +2681,7 @@
26812681
"ratings": {
26822682
"type": "array",
26832683
"title": "Ratings",
2684-
"description": "List of vulnerability ratings",
2684+
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
26852685
"items": {
26862686
"$ref": "#/definitions/rating"
26872687
}

schema/bom-1.6.xsd

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4218,7 +4218,7 @@ limitations under the License.
42184218
</xs:element>
42194219
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
42204220
<xs:annotation>
4221-
<xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation>
4221+
<xs:documentation xml:lang="en">List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.</xs:documentation>
42224222
</xs:annotation>
42234223
<xs:complexType>
42244224
<xs:sequence>

schema/bom-1.7.proto

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import "google/protobuf/timestamp.proto";
44

55
// Specifies attributes of the text
66
message AttachedText {
7-
// Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents. [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).
7+
// Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents. [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).
88
optional string content_type = 1;
99
// Specifies the encoding the text is represented in
1010
optional string encoding = 2;
@@ -990,7 +990,7 @@ message Vulnerability {
990990
optional Source source = 3;
991991
// Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Oftentimes, the same vulnerability may exist in multiple sources of vulnerability intelligence but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.
992992
repeated VulnerabilityReference references = 4;
993-
// List of vulnerability ratings
993+
// List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.
994994
repeated VulnerabilityRating ratings = 5;
995995
// List of Common Weaknesses Enumerations (CWEs) codes that describe this vulnerability. For example, 399 (of https://cwe.mitre.org/data/definitions/399.html)
996996
repeated int32 cwes = 6;

schema/bom-1.7.schema.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2841,7 +2841,7 @@
28412841
"ratings": {
28422842
"type": "array",
28432843
"title": "Ratings",
2844-
"description": "List of vulnerability ratings",
2844+
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
28452845
"items": {
28462846
"$ref": "#/definitions/rating"
28472847
}

schema/bom-1.7.xsd

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4461,7 +4461,7 @@ limitations under the License.
44614461
</xs:element>
44624462
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
44634463
<xs:annotation>
4464-
<xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation>
4464+
<xs:documentation xml:lang="en">List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.</xs:documentation>
44654465
</xs:annotation>
44664466
<xs:complexType>
44674467
<xs:sequence>

0 commit comments

Comments
 (0)