Merge pull request #1292 from paketo-buildpacks/source-info

adds source uri/sha fields support

actions/Dockerfile

@@ -1,6 +1,4 @@
-FROM golang:1.18 as build-stage
-
-RUN apt-get update && apt-get install -y --no-install-recommends upx
+FROM golang:1.20 as build-stage
 
 WORKDIR /src
 ENV GO111MODULE=on CGO_ENABLED=0
@@ -17,8 +15,6 @@ RUN go build \
 
 RUN strip /bin/action
 
-RUN upx -q -9 /bin/action
-
 FROM scratch
 COPY --from=build-stage /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build-stage /bin/action /bin/action

actions/action.go

@@ -59,6 +59,13 @@ func NewOutputs(uri string, latestVersion *semver.Version, additionalOutputs Out
 	}
 
 	for k, v := range additionalOutputs {
+		if k == "source" {
+			sourceSha256, err := SHA256FromURI(v, mods...)
+			if err != nil {
+				return nil, fmt.Errorf("unable to calculate source sha256\n%w", err)
+			}
+			outputs["source_sha256"] = sourceSha256
+		}
 		outputs[k] = v
 	}
 

actions/maven-dependency/main.go

@@ -68,18 +68,28 @@ func main() {
 		panic(fmt.Errorf("unable to decode payload\n%w", err))
 	}
 
+	sources := make(map[string]string)
 	versions := make(actions.Versions)
 	for _, v := range raw.Versioning.Versions {
 		if p := versionPattern.MatchString(v); p {
 			w := fmt.Sprintf("%s/%s/%s/%s", u, strings.ReplaceAll(g, ".", "/"), a, v)
 			w = fmt.Sprintf("%s/%s-%s", w, a, v)
+			src := w
+
 			if s, ok := inputs["classifier"]; ok {
 				w = fmt.Sprintf("%s-%s", w, s)
 			}
+			if sc, ok := inputs["source_classifier"]; ok {
+				src = fmt.Sprintf("%s-%s", src, sc)
+			} else {
+				src = fmt.Sprintf("%s-%s", src, "src")
+			}
 			if s, ok := inputs["packaging"]; ok {
 				w = fmt.Sprintf("%s.%s", w, s)
+				src = fmt.Sprintf("%s.%s", src, s)
 			} else {
 				w = fmt.Sprintf("%s.jar", w)
+				src = fmt.Sprintf("%s.jar", src)
 			}
 
 			n, err := actions.NormalizeVersion(v)
@@ -88,12 +98,23 @@ func main() {
 			}
 
 			versions[n] = w
+			sources[n] = src
 		}
 	}
 
-	if o, err := versions.GetLatest(inputs); err != nil {
+	latestVersion, err := versions.GetLatestVersion(inputs)
+	if err != nil {
+		panic(err)
+	}
+	latestSource := actions.Outputs{}
+	if sources != nil {
+		latestSource["source"] = sources[latestVersion.Original()]
+	}
+
+	o, err := actions.NewOutputs(versions[latestVersion.Original()], latestVersion,  latestSource)
+	if err != nil {
 		panic(err)
-	} else {
+	}else {
 		o.Write()
 	}
 }
@@ -104,4 +125,4 @@ type Metadata struct {
 
 type Versioning struct {
 	Versions []string `xml:"versions>version"`
-}
+}

actions/tomee-dependency/main.go

@@ -48,6 +48,8 @@ func main() {
 	c := colly.NewCollector()
 
 	versions := make(actions.Versions)
+	sources := make(map[string]string)
+
 	c.OnHTML("a[href]", func(element *colly.HTMLElement) {
 		if p := TomeeVersionPattern.FindStringSubmatch(element.Attr("href")); p != nil {
 			if major == "" || major == p[1] {
@@ -59,6 +61,7 @@ func main() {
 				}
 
 				versions[verKey] = fmt.Sprintf("%s/tomee-%[2]s/apache-tomee-%[2]s-%s.tar.gz", uri, verVal, dist)
+				sources[verKey] = fmt.Sprintf("%s/tomee-%[2]s/tomee-project-%[2]s-source-release.zip", uri, verVal, dist)
 			}
 		}
 	})
@@ -71,8 +74,12 @@ func main() {
 	if err != nil {
 		panic(err)
 	}
+	latestSource := actions.Outputs{}
+	if sources != nil {
+		latestSource["source"] = sources[latestVersion.Original()]
+	}
 
-	o, err := actions.NewOutputs(versions[latestVersion.Original()], latestVersion, nil)
+	o, err := actions.NewOutputs(versions[latestVersion.Original()], latestVersion,  latestSource)
 	if err != nil {
 		panic(err)
 	}

octo/buildpack_dependencies.go

@@ -75,6 +75,8 @@ func ContributeBuildpackDependencies(descriptor Descriptor) ([]Contribution, err
 								"CPE_PATTERN":     d.CPEPattern,
 								"PURL":            "${{ steps.dependency.outputs.purl }}",
 								"PURL_PATTERN":    d.PURLPattern,
+								"SOURCE_URI":      "${{ steps.dependency.outputs.source }}",
+								"SOURCE_SHA256":      "${{ steps.dependency.outputs.source_sha256 }}",
 							},
 						}, {
 							Uses: "peter-evans/create-pull-request@v5",

octo/update-buildpack-dependency.sh

@@ -18,7 +18,9 @@ update-buildpack-dependency \
   --purl-pattern "${PURL_PATTERN:-}" \
   --purl "${PURL:-}" \
   --uri "${URI}" \
-  --sha256 "${SHA256}"
+  --sha256 "${SHA256}" \
+  --source "${SOURCE_URI}" \
+  --source-sha256 "${SOURCE_SHA256}"
 
 git add buildpack.toml
 git checkout -- .