X Tutup
Skip to content

Add SBOM manifest to nuget packages#16711

Merged
adityapatwardhan merged 11 commits intoPowerShell:masterfrom
PaulHigin:nugetpkg-sbom
Jan 31, 2022
Merged

Add SBOM manifest to nuget packages#16711
adityapatwardhan merged 11 commits intoPowerShell:masterfrom
PaulHigin:nugetpkg-sbom

Conversation

@PaulHigin
Copy link
Copy Markdown
Contributor

@PaulHigin PaulHigin commented Jan 6, 2022

This PR adds SBOM manifests for created nuget packages for coordinated package builds.

SBOM manifests are added by splitting the existing New-ILNugetPacakge function, which creates all nuget packages at once, into New-ILNugetPackageSource and New-ILNugetPackageFromSource functions. These new functions create source and package for just one file at a time, so that an SBOM manifest can be created (via yml template) for each file/package.

PR Checklist

@ghost ghost assigned PaulHigin Jan 6, 2022
@PaulHigin PaulHigin assigned TravisEz13 and unassigned PaulHigin Jan 6, 2022
@PaulHigin PaulHigin requested review from JamesWTruher and removed request for anmenaga January 7, 2022 21:42
JamesWTruher
JamesWTruher approved these changes Jan 7, 2022
View reviewed changes
Copy link
Copy Markdown
Collaborator

@JamesWTruher JamesWTruher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just a couple of suggestions but otherwise looks good

PaulHigin and others added 3 commits January 10, 2022 09:51
@PaulHigin @JamesWTruher
Update tools/packaging/packaging.psm1
c41186e 
Co-authored-by: James Truher [MSFT] <jimtru@microsoft.com>
@PaulHigin @JamesWTruher
Update tools/releaseBuild/azureDevOps/templates/nuget-pkg-sbom.yml
641c7a9 
Co-authored-by: James Truher [MSFT] <jimtru@microsoft.com>
@PaulHigin
Update nuget-pkg-sbom.yml
3f6ad8e 
Reverting incorrect change to verbose message.
@ghost ghost added the Review - Needed The PR is being reviewed label Jan 18, 2022
@ghost
Copy link
Copy Markdown

ghost commented Jan 18, 2022

This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days.
Maintainer, please provide feedback and/or mark it as Waiting on Author

TravisEz13
TravisEz13 reviewed Jan 19, 2022
View reviewed changes
TravisEz13
TravisEz13 requested changes Jan 19, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@TravisEz13 TravisEz13 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please give your thoughts on the comments I left

@ghost ghost added Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept and removed Review - Needed The PR is being reviewed Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept labels Jan 19, 2022
TravisEz13
TravisEz13 requested changes Jan 25, 2022
View reviewed changes
@ghost ghost added Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept and removed Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept labels Jan 25, 2022
@PaulHigin
Copy link
Copy Markdown
Contributor Author

PaulHigin commented Jan 27, 2022

@adityapatwardhan Ping...

adityapatwardhan
adityapatwardhan requested changes Jan 28, 2022
View reviewed changes
@ghost ghost added Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept and removed Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept labels Jan 28, 2022
@pull-request-quantifier-deprecated
Copy link
Copy Markdown

pull-request-quantifier-deprecated bot commented Jan 31, 2022

This PR has 428 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details 

Label      : Extra Large
Size       : +293 -135
Percentile : 80.93%

Total files changed: 6

Change summary by file extension:
.psm1 : +214 -127
.json : +1 -1
.psd1 : +2 -0
.yml : +76 -7

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

  • Fast and predictable releases to production:
    • Optimal size changes are more likely to be reviewed faster with fewer
      iterations.
    • Similarity in low PR complexity drives similar review times.
  • Review quality is likely higher as complexity is lower:
    • Bugs are more likely to be detected.
    • Code inconsistencies are more likely to be detetcted.
  • Knowledge sharing is improved within the participants:
    • Small portions can be assimilated better.
  • Better engineering practices are exercised:
    • Solving big problems by dividing them in well contained, smaller problems.
    • Exercising separation of concerns within the code changes.

What can I do to optimize my changes

  • Use the PullRequestQuantifier to quantify your PR accurately
    • Create a context profile for your repo using the context generator
    • Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
    • Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
    • Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
  • Change your engineering behaviors
    • For PRs that fall outside of the desired spectrum, review the details and check if:
      • Your PR could be split in smaller, self-contained PRs instead
      • Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

  • One line was added: +1 -0
  • One line was deleted: +0 -1
  • One line was modified: +1 -1 (git diff doesn't know about modified, it will
    interpret that line like one addition plus one deletion)
  • Change percentiles: Change characteristics (addition, deletion, modification)
    of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍  :ok_hand:  :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

@adityapatwardhan adityapatwardhan added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label Jan 31, 2022
@adityapatwardhan adityapatwardhan merged commit 8af0834 into PowerShell:master Jan 31, 2022
@PaulHigin PaulHigin deleted the nugetpkg-sbom branch January 31, 2022 20:41
@ghost
Copy link
Copy Markdown

ghost commented Feb 24, 2022

🎉v7.3.0-preview.2 has been released which incorporates this pull request.:tada:

Handy links:

daxian-dbw pushed a commit to daxian-dbw/PowerShell that referenced this pull request Mar 9, 2022
@PaulHigin @TravisEz13
Add SBOM manifest to nuget packages (PowerShell#16711)
d1d92a3 
# Conflicts:
#	build.psm1
#	tools/cgmanifest.json
daxian-dbw pushed a commit to daxian-dbw/PowerShell that referenced this pull request Mar 14, 2022
@PaulHigin @TravisEz13
Add SBOM manifest to nuget packages (PowerShell#16711)
079066d 
# Conflicts:
#	build.psm1
#	tools/cgmanifest.json

# Conflicts:
#	build.psm1
#	tools/cgmanifest.json
#	tools/packaging/packaging.psm1
#	tools/releaseBuild/azureDevOps/templates/nuget.yml
daxian-dbw pushed a commit to daxian-dbw/PowerShell that referenced this pull request Mar 15, 2022
@PaulHigin @TravisEz13
Add SBOM manifest to nuget packages (PowerShell#16711)
8b83303 
# Conflicts:
#	build.psm1
#	tools/cgmanifest.json

# Conflicts:
#	build.psm1
#	tools/cgmanifest.json
#	tools/packaging/packaging.psm1
#	tools/releaseBuild/azureDevOps/templates/nuget.yml

# Conflicts:
#	tools/packaging/packaging.psm1
#	tools/releaseBuild/azureDevOps/templates/nuget.yml
@TravisEz13 TravisEz13 mentioned this pull request May 24, 2022
Merged
@TravisEz13 TravisEz13 mentioned this pull request Jun 7, 2022
Merged
22 tasks
@TravisEz13 TravisEz13 mentioned this pull request Oct 12, 2022
Merged
22 tasks
@TravisEz13 TravisEz13 mentioned this pull request Apr 16, 2024
Closed
@TravisEz13 TravisEz13 mentioned this pull request Jul 9, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TravisEz13 TravisEz13 TravisEz13 approved these changes

@adityapatwardhan adityapatwardhan adityapatwardhan approved these changes

@daxian-dbw daxian-dbw Awaiting requested review from daxian-dbw

+1 more reviewer

@JamesWTruher JamesWTruher JamesWTruher approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@TravisEz13 TravisEz13

Labels

Backport-7.0.x-Done BackPort-7.1.x-Done Backport to 7.1.x completed Backport-7.2.x-Done CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log Extra Large

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@PaulHigin @JamesWTruher @TravisEz13 @adityapatwardhan
X Tutup