pipeline.yml

---
resource_types:
- name: build-metadata-resource
  type: registry-image
  source:
    repository: harbor-repo.vmware.com/dockerhub-proxy-cache/pcfopsmanager/build-metadata-resource
    tag: latest

resources:
- name: bpm-release
  type: git
  icon: github
  source:
    uri: git@github.com:dtimm/bpm-release.git
    branch: master
    private_key: ((signing_test.dtimm_bpm_private_key))
- name: bosh-secure-supply-chain
  type: git
  icon: github
  source:
    uri: git@github.com:dtimm/bosh-secure-supply-chain.git
    branch: main
    private_key: ((signing_test.private_key))
- name: build-metadata
  type: build-metadata-resource

jobs:
- name: generate-sbom-provenance
  serial: true
  plan:
  - in_parallel:
    - get: bpm-release
    - get: bosh-secure-supply-chain
    - put: build-metadata
  - task: generate-gomod-sbom
    file: bosh-secure-supply-chain/concourse/gomod_vendor_sbom/task.yml
    input_mapping:
      bosh-release: bpm-release
    params:
      COSIGN_KEY: ((signing_test.cosign_key))
      COSIGN_PASSWORD: ((signing_test.cosign_key_password))
  - task: copy-attestations-to-repo
    config:
      image_resource:
        type: registry-image
        source:
          repository: harbor-repo.vmware.com/tas_ppe/cosign
          tag: 0.0.5-beta
      platform: linux
      inputs:
      - name: bpm-release
      - name: attestations
      outputs:
      - name: bpm-release
      run:
        path: bash
        args:
        - -c
        - |
          set -eux
          cp attestations/* bpm-release/src
          pushd bpm-release
            git config --global user.email "dtimm@vmware.com"
            git config --global user.name "David Timm"
            git add src
            git commit -m "Add attestations"
          popd
  - put: bpm-release
    params: { repository: bpm-release }
- name: build-bosh-release
  serial: true
  plan:
  - in_parallel:
    - get: bpm-release
      passed: [generate-sbom-provenance]
    - get: bosh-secure-supply-chain
    - put: build-metadata
  - task: build-bpm-release-1.2.5
    file: bosh-secure-supply-chain/concourse/bosh_create_release/task.yml
    input_mapping:
      bosh-release: bpm-release
    params:
      COSIGN_KEY: ((signing_test.cosign_key))
      COSIGN_PASSWORD: ((signing_test.cosign_key_password))
      BOSH_RELEASE_FILE: releases/bpm/bpm-1.2.5.yml