binary-builds.yml

name: Binary builds

on:
  push:
    branches:
      - master
      - release/*
    tags:
      - 'v*'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  sae-builds:
    if: github.repository == 'CycloneDX/cdxgen'
    strategy:
      matrix:
        os: ['ubuntu-latest', 'windows-latest', 'arm64']
        include:
          - os: ubuntu-latest
            build: |
              rm -rf ci contrib tools_config
              npx --yes @appthreat/caxa --input . --output "cdxgen" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
              chmod +x cdxgen
              ./cdxgen --version
              sha256sum cdxgen > cdxgen.sha256
              rm -rf node_modules
              npm install --omit=optional --omit=dev --no-package-lock --no-audit --no-fund --no-progress
              npx --yes @appthreat/caxa --input . --output "cdxgen-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
              chmod +x cdxgen-slim
              ./cdxgen-slim --version
              sha256sum cdxgen-slim > cdxgen-slim.sha256
              npx --yes @appthreat/caxa --input . --output "cdx-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
              chmod +x cdx-verify
              ./cdx-verify --version
              sha256sum cdx-verify > cdx-verify.sha256
              ./cdxgen --help
              ./cdxgen-slim --help
            artifact: cdxgen
            sartifact: cdxgen-slim
            vartifact: cdx-verify
          - os: arm64
            build: |
              rm -rf ci contrib tools_config
              npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-arm64" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
              chmod +x cdxgen-arm64
              ./cdxgen-arm64 --version
              sha256sum cdxgen-arm64 > cdxgen-arm64.sha256
              rm -rf node_modules
              npm install --omit=optional --omit=dev --no-package-lock --no-audit --no-fund --no-progress --loglevel verbose
              npx --no-progress --yes @appthreat/caxa --input . --output "cdxgen-arm64-slim" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
              chmod +x cdxgen-arm64-slim
              ./cdxgen-arm64-slim --version
              sha256sum cdxgen-arm64-slim > cdxgen-arm64-slim.sha256
              npx --no-progress --yes @appthreat/caxa --input . --output "cdx-arm64-verify" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
              chmod +x cdx-arm64-verify
              ./cdx-arm64-verify --version
              sha256sum cdx-arm64-verify > cdx-arm64-verify.sha256
              ./cdxgen-arm64 --help
              ./cdxgen-arm64-slim --help
            artifact: cdxgen-arm64
            sartifact: cdxgen-arm64-slim
            vartifact: cdx-arm64-verify
          - os: windows-latest
            build: |
              Remove-Item ci -Recurse -Force
              Remove-Item contrib -Recurse -Force
              Remove-Item tools_config -Recurse -Force
              npx @appthreat/caxa --input . --output "cdxgen.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
              .\cdxgen.exe --version
              (Get-FileHash .\cdxgen.exe).hash | Out-File -FilePath .\cdxgen.exe.sha256
              Remove-Item node_modules -Recurse -Force
              npm install --omit=optional --omit=dev --no-package-lock --no-audit --no-fund
              npx @appthreat/caxa --input . --output "cdxgen-slim.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/cdxgen.js"
              .\cdxgen-slim.exe --version
              (Get-FileHash .\cdxgen-slim.exe).hash | Out-File -FilePath .\cdxgen-slim.exe.sha256
              npx @appthreat/caxa --input . --output "cdx-verify.exe" -- "{{caxa}}/node_modules/.bin/node" "{{caxa}}/bin/verify.js"
              .\cdx-verify.exe --version
              (Get-FileHash .\cdx-verify.exe).hash | Out-File -FilePath .\cdx-verify.exe.sha256
              .\cdxgen.exe --help
              .\cdxgen-slim.exe --help
            artifact: cdxgen.exe
            sartifact: cdxgen-slim.exe
            vartifact: cdx-verify.exe
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '23.x'
      - name: Produce sae
        run: |
          npm install --omit=dev --no-package-lock --no-audit --no-fund --no-progress --loglevel verbose
          ${{ matrix.build }}
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.sartifact }}
          path: ${{ matrix.sartifact }}
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.vartifact }}
          path: ${{ matrix.vartifact }}
      - name: Release
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            ${{ matrix.artifact }}
            ${{ matrix.artifact }}.sha256
            ${{ matrix.sartifact }}
            ${{ matrix.sartifact }}.sha256
            ${{ matrix.vartifact }}
            ${{ matrix.vartifact }}.sha256