up

ops/devops/sbom-ci-runner/README.md

@@ -0,0 +1,29 @@
+# SBOM Service CI Runner Harness (DEVOPS-SBOM-23-001)
+
+Purpose: deterministic, offline-friendly CI harness for SBOM Service. Produces warmed-cache restore, build binlog, TRX outputs, and a NuGet cache hash to unblock SBOM console/consumer sprints.
+
+Usage
+- From repo root run: `ops/devops/sbom-ci-runner/run-sbom-ci.sh`
+- Outputs land in `ops/devops/artifacts/sbom-ci/<UTC timestamp>/`:
+  - `build.binlog` (solution build)
+  - `tests/sbom.trx` (VSTest results)
+  - `nuget-cache.hash` (sha256 over file name+size listing for offline cache traceability)
+  - `summary.json` (paths + sources + cache hash)
+
+Environment defaults
+- `DOTNET_CLI_TELEMETRY_OPTOUT=1`, `DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1`, `DOTNET_RESTORE_DISABLE_PARALLEL=1`
+- `NUGET_PACKAGES=$REPO/.nuget/packages`
+- `NUGET_SOURCES=$REPO/local-nugets;$REPO/.nuget/packages`
+- `TEST_FILTER` empty (set to narrow tests)
+
+What it does
+1) Warm NuGet cache from `local-nugets/` into `$NUGET_PACKAGES` for air-gap parity.
+2) `dotnet restore` + `dotnet build` on `src/SbomService/StellaOps.SbomService.sln` with `/bl`.
+3) Run `StellaOps.SbomService.Tests` with TRX output (honors `TEST_FILTER`).
+4) Produce `nuget-cache.hash` using sorted file name+size list hashed with sha256 (lightweight evidence of cache contents).
+5) Emit `summary.json` with artefact paths and cache hash value.
+
+Notes
+- Offline-only; no external services required.
+- Timestamped output folders keep ordering deterministic; consumers should sort lexicographically.
+- Extend `test_project` in the script if additional SBOM test projects are added.

ops/devops/sbom-ci-runner/run-sbom-ci.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# SBOM Service CI runner (DEVOPS-SBOM-23-001)
+# Builds SBOM solution and runs tests with warmed NuGet cache; emits binlog + TRX + cache hash summary.
+
+repo_root="$(cd "$(dirname "$0")/../../.." && pwd)"
+ts="$(date -u +%Y%m%dT%H%M%SZ)"
+out_dir="$repo_root/ops/devops/artifacts/sbom-ci/$ts"
+logs_dir="$out_dir/tests"
+mkdir -p "$logs_dir"
+
+export DOTNET_CLI_TELEMETRY_OPTOUT=${DOTNET_CLI_TELEMETRY_OPTOUT:-1}
+export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=${DOTNET_SKIP_FIRST_TIME_EXPERIENCE:-1}
+export DOTNET_RESTORE_DISABLE_PARALLEL=${DOTNET_RESTORE_DISABLE_PARALLEL:-1}
+export NUGET_PACKAGES=${NUGET_PACKAGES:-$repo_root/.nuget/packages}
+export NUGET_SOURCES=${NUGET_SOURCES:-"$repo_root/local-nugets;$repo_root/.nuget/packages"}
+export TEST_FILTER=${TEST_FILTER:-""}
+
+mkdir -p "$NUGET_PACKAGES"
+rsync -a "$repo_root/local-nugets/" "$NUGET_PACKAGES/" >/dev/null 2>&1 || true
+
+restore_sources=()
+IFS=';' read -ra SRC_ARR <<< "$NUGET_SOURCES"
+for s in "${SRC_ARR[@]}"; do
+  [[ -n "$s" ]] && restore_sources+=(--source "$s")
+done
+
+solution="$repo_root/src/SbomService/StellaOps.SbomService.sln"
+dotnet restore "$solution" --ignore-failed-sources "${restore_sources[@]}"
+
+build_binlog="$out_dir/build.binlog"
+dotnet build "$solution" -c Release /p:ContinuousIntegrationBuild=true /bl:"$build_binlog"
+
+trx_name="sbom.trx"
+test_project="$repo_root/src/SbomService/StellaOps.SbomService.Tests/StellaOps.SbomService.Tests.csproj"
+common_test_args=( -c Release --no-build --results-directory "$logs_dir" )
+if [[ -n "$TEST_FILTER" ]]; then
+  common_test_args+=( --filter "$TEST_FILTER" )
+fi
+
+if [[ -f "$test_project" ]]; then
+  dotnet test "$test_project" "${common_test_args[@]}" --logger "trx;LogFileName=$trx_name"
+fi
+
+# Lightweight cache hash: list files with size, hash the listing
+cache_listing="$out_dir/nuget-cache.list"
+find "$NUGET_PACKAGES" -type f -printf "%P %s\n" | sort > "$cache_listing"
+cache_hash=$(sha256sum "$cache_listing" | awk '{print $1}')
+
+echo "$cache_hash  nuget-cache.list" > "$out_dir/nuget-cache.hash"
+
+summary="$out_dir/summary.json"
+{
+  printf '{\n'
+  printf '  "timestamp_utc": "%s",\n' "$ts"
+  printf '  "build_binlog": "%s",\n' "${build_binlog#${repo_root}/}"
+  printf '  "tests": [\n'
+  printf '    {"project":"SbomService","trx":"%s"}\n' "${logs_dir#${repo_root}/}/$trx_name"
+  printf '  ],\n'
+  printf '  "nuget_packages": "%s",\n' "${NUGET_PACKAGES#${repo_root}/}"
+  printf '  "cache_hash": "%s",\n' "$cache_hash"
+  printf '  "sources": [\n'
+  for i in "${!SRC_ARR[@]}"; do
+    sep=","; [[ $i -eq $((${#SRC_ARR[@]}-1)) ]] && sep=""
+    printf '    "%s"%s\n' "${SRC_ARR[$i]}" "$sep"
+  done
+  printf '  ]\n'
+  printf '}\n'
+} > "$summary"
+
+echo "Artifacts written to ${out_dir#${repo_root}/}"