test

.gitea/workflows/build-go.yaml

@@ -23,19 +23,6 @@ jobs:
           echo "LATEST=$LATEST_NUM" >> $GITHUB_ENV
           echo "Latest Go version: $LATEST_NUM"
 
-#      - name: Check if package already exists
-#        env:
-#          GITEA_TOKEN: ${{ secrets.CI_BOT_TOKEN }}
-#          LATEST: ${{ env.LATEST }}
-#        run: |
-#          EXISTS=$(curl -s -H "Authorization: token $GITEA_TOKEN" \
-#            "https://gitea.lulz.ltd/api/packages/list?owner=stacksmith&repo=go" || echo "[]" \
-#            | jq -r ".[] | select(.name==\"golang\" and .version==\"${LATEST}-debian12\") | .name")
-#          if [ -n "$EXISTS" ]; then
-#            echo "Package golang-${LATEST}-debian12 already exists. Skipping build."
-#            exit 0
-#          fi
-
       - name: Download official Go tarball
         env:
           LATEST: ${{ env.LATEST }}
@@ -44,43 +31,30 @@ jobs:
           curl -LO https://go.dev/dl/go${LATEST}.linux-amd64.tar.gz
           mkdir -p golang-${LATEST}-linux-amd64-debian-12/files
           tar -xzf go${LATEST}.linux-amd64.tar.gz -C golang-${LATEST}-linux-amd64-debian-12/files
-#          ls -R golang-${LATEST}-linux-amd64-debian-12/files
 
       - name: Package tarball
         env:
           LATEST: ${{ env.LATEST }}
         run: |
           tar -czf golang-${LATEST}-linux-amd64-debian-12.tar.gz golang-${LATEST}-linux-amd64-debian-12
-          ls -lh golang-${LATEST}-linux-amd64-debian-12.tar.gz
+
+      - name: Install Syft
+        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b .
+
+      - name: Generate SPDX SBOM
+        run: |
+          ./syft packages golang-${LATEST}-linux-amd64-debian-12.tar.gz -o spdx-json \
+          > golang-${LATEST}-linux-amd64-debian-12.spdx
 
       - name: Generate SHA256 checksum
         run: |
           sha256sum golang-${LATEST}-linux-amd64-debian-12.tar.gz > golang-${LATEST}-linux-amd64-debian-12.tar.gz.sha256
           cat golang-${LATEST}-linux-amd64-debian-12.tar.gz.sha256
 
-#      - name: Upload to Gitea Packages
-#        env:
-#          GITEA_TOKEN: ${{ secrets.CI_BOT_TOKEN }}
-#          LATEST: ${{ env.LATEST }}
-#        run: |
-#          curl -X POST \
-#               -H "Authorization: token $GITEA_TOKEN" \
-#               -F "package=@golang-${LATEST}-linux-amd64-debian-12.tar.gz" \
-#               "https://gitea.lulz.ltd/api/packages/upload?owner=stacksmith&repo=go&package_name=golang&package_version=${LATEST}-debian12"
-#                --upload-file "$TARFILE" \
-#               "https://gitea.lulz.ltd/api/packages/${OWNER}/generic/${REPOSITORY}/${VERSION}/$(basename $TARFILE)"
-
-#      - name: Install MinIO Client
-#        run: |
-#          wget https://dl.min.io/client/mc/release/linux-amd64/mc
-#          chmod +x mc
-#          sudo mv mc /usr/local/bin/
-
       - name: Install MinIO Client
         run: |
           wget https://dl.min.io/client/mc/release/linux-amd64/mc
           chmod +x mc
-#          mv mc ./mc
 
       - name: Configure MinIO
         env:
@@ -93,3 +67,4 @@ jobs:
         run: |
           ./mc cp golang-${LATEST}-linux-amd64-debian-12.tar.gz upload/downloads/stacksmith/
           ./mc cp golang-${LATEST}-linux-amd64-debian-12.tar.gz.sha256 upload/downloads/stacksmith/
+          ./mc cp golang-${LATEST}-linux-amd64-debian-12.spdx upload/downloads/stacksmith/