- Introduced multiple Packer templates for generating SBOMs on various platforms including Amazon Linux, FreeBSD, RHEL, and Windows.
- Added Docker templates for Linux with both legacy and no-exec styles.
- Implemented a script to run SBOM case matrix tests, ensuring templates are executable and logging results.
- Updated .gitignore to include necessary files and directories.
- Enhanced existing Windows templates to support legacy execution styles.
- Changed `AutoGenerate` field in `FlatConfig` from required to optional.
- Added `ScannerArgs` field to `FlatConfig`.
- Updated HCL2Spec to reflect changes in `FlatConfig`.
- Modified test cases in `provisioner_test.go` to accommodate changes in `AutoGenerate` and `ScannerArgs`.
- Updated `ExecuteCommand` in tests to use the new command format.
- Removed unused `syft_dependency.go` file as it is no longer necessary.
Co-authored-by: Copilot <[email protected]>
Prevents unnecessary update operations by checking if the
bucket's description and labels already match the requested
values before issuing an update.
Improves efficiency and avoids redundant API calls.
* Bump version to 1.15.2 and update changelog for release
* Cleanup changelog by removing outdated entries and sensitive data ref… (#13619)
* Cleanup changelog by removing outdated entries and sensitive data references
* Clarify provisioner behavior in changelog to improve understanding of lifecycle enforcement
* Update changelog to clarify provisioner lifecycle enforcement and remove outdated bug fix entry
Co-authored-by: Copilot <[email protected]>
---------
Co-authored-by: Copilot <[email protected]>
---------
Co-authored-by: Copilot <[email protected]>
Aligns project with Go 1.25.9 and updates several dependencies
to incorporate bug fixes, security enhancements, and improved
compatibility across packages.
Ensures continued stability and support for the latest upstream
features by tracking current releases.
* added the parser for the enforced block
* Enhance enforced provisioner parsing to support HCL and JSON formats
- Updated ParseProvisionerBlocks to handle both HCL and JSON syntax, including legacy JSON format.
- Added comprehensive test cases for JSON provisioner parsing.
- Improved ExtractBuildProvisionerHCL to merge inline commands from shell provisioners.
- Enhanced logging for enforced block operations in HCP Packer.
* Remove PublishEnforcedBlocks function from Bucket struct
* Remove ExtractBuildProvisionerHCL function and unused imports
* Reverted the version upgrade
* Added the internal-sdk for the enforcedProvsioner api changes
* Enhance enforced provisioner handling and error reporting
- Update error handling in FetchEnforcedBlocks to return detailed errors instead of warnings.
- Modify GetCoreBuildProvisionerFromBlock to accept build name for overrides.
- Add tests for FetchEnforcedBlocks to ensure correct behavior and error handling.
- Implement diagnostics for unsupported legacy JSON templates.
* Implement enforced provisioner parsing and handling
- Introduced a new package `enforcedparser` to handle parsing of enforced provisioner blocks from HCL and JSON formats.
- Refactored existing code to utilize the new `ParseProvisionerBlocks` function from the `enforcedparser` package.
- Updated `GetCoreBuildProvisionerFromEnforcedBlock` method to convert enforced provisioner blocks into core build provisioners.
- Enhanced error handling and logging during the parsing process.
- Added tests for the new parsing functionality and ensured existing tests were updated to reflect changes.
- Modified `InjectEnforcedProvisioners` method in JSON registry to utilize the new parsing logic.
* Add test case for -skip-enforcement flag in BuildArgs
* Refactor sensitive variable handling in provisioners and add related tests
* Refactor enforced provisioner handling: remove internal parser, update tests, and streamline API interactions
* Enhance provisioner block parsing: add error handling for invalid combinations and expand test coverage
* Remove internal SDK replacement for enforced block types in go.mod
* Update dependencies in go.mod and go.sum: bump hcp-sdk-go and packer-plugin-sdk versions, adjust syft version, and update OpenTelemetry packages
* Update hcp-sdk-go dependency to v0.172.0 in go.mod and go.sum
* Fix formatting in TestBuildCommand_ParseArgs and add newline at end of json_enforced_test.go
* Refactor testJSONRegistryWithBuilds: remove environment variable setup and streamline registry initialization
* Rename injected variable for clarity in InjectEnforcedProvisioners function
---------
Co-authored-by: Hari Om <[email protected]>
The syft library has a transitive dependency on containerd, which includes
platform-specific code that doesn't compile on NetBSD, OpenBSD, and Solaris.
This change adds build constraints to exclude the syft import on these
platforms. The hcp-sbom provisioner functionality is unaffected since it
downloads and executes pre-built syft binaries at runtime rather than
using the Go library directly. The import exists solely for dependency
tracking in license and security scanning tools.
* add configuration fields to SBOMInternalProvisioner
* add os detection
* move implementation to hcp-sbom
* upload scanner binary and execute
* use latest syft version always
* reduce duplicate code
* rename config fields appropriately
* default to cyclonedx
* add syft dependency
* add support for elevated user for windows
* add retry for download
* add syft dependency
Updates go version
* optimization for windows
* improve docs
* update config usage rules
* add unit tests
* update golang version, fix linter issues
* refactor and improvements
* simplify few lines
* refactor retry for scanner download
* resolved conflicts
* resolve conflicts from main
* stick to syft v1 for compatibility
* fix lint issues
* stricter version check for syft
* fix version eg
* update go version to 1.25.7
* go mod changes
Configures automated dependency updates for GitHub Actions workflows,
groups all actions in a single pull request, schedules updates monthly,
and ignores major version bumps to reduce noise and streamline updates.
Hari Om
Tanmay Jain
dependabot[bot]
Anurag Sharma