ci-jenkins-pipelines
ci-jenkins-pipelines copied to clipboard
EPIC: Add a Post-Build job and Sign-SBOM job
Create a new job "Post-Build" which implements issue, this encompasses all post-build tasks. To this job we will then run a new job "Sign-SBOM" on the "signing node", with the available RSA key.
- Compiles and build TemurinSignSBOM
- Signs and Verifies SBOM Signature
Publishes Artifacts:
- Signed SBOM artifact
Tasks:
- [x] #1105
- [ ] Request Adoptium PEM private&public key pair from EF, request
- [ ] https://github.com/adoptium/temurin-build/issues/3946
- [ ] Create new Post-Build job, and a new Sign-SBOM job using TemurinSignSBOM
Additional post build tasks to consider hanging off of this job:
- Triggering release notes job
- Auto-creation of draft PR for next release blog post (to use to capture 'featured' items ahead of time)
Additional Post-build task
- EclipseMirror activity (currently a job on TC Jenkins) to backup release tarballs (job runs on TC Jenkins server, but potentially can be remotely triggered from this Post-build job to consolidate triggering of various tasks in one spot)
Also download testing as per https://github.com/adoptium/temurin-build/issues/3506 which includes SBoM validation.
This is currently performed by the standalone download_and_sbom_validation job which uses the release_download_test.sh script