build-cpp-linux.yml

# Precondition:
# - The Conan lock file (conan_linux_rpi.lock) must exist.

name: Build and Test Apps for Linux

on:
  push:
    branches: [ "master", "v1*", "v2*", "v3*" ]
    paths:
      - ".github/**"
      - 'control_cpp/**'
      - 'minimal_cpp/**'
      - 'monitor_cpp/**'
  pull_request:
    branches: [ "master", "v1*", "v2*", "v3*" ]
    paths:
      - ".github/**"
      - 'control_cpp/**'
      - 'minimal_cpp/**'
      - 'monitor_cpp/**'

jobs:
  # Bereitet die Abhängigkeiten für RPi vor.
  build_dependencies_rpi:
    runs-on: CPR_Ubuntu2404
    timeout-minutes: 130

    steps:
    - uses: actions/checkout@v7
      with:
        submodules: true

    - uses: CommonplaceRobotics/Action_Build_Conan_Dependencies/Linux_armv8_32@v2
      with:
        lockfile: 'conan_linux_rpi.lock'
        cache_key: conan-${{ runner.os }}-armv8_32-${{ hashFiles('**/conan_linux_rpi.lock', '**/conanfile.py') }}
        conan_cache_user: ${{ secrets.ARTIFACTORY_USER }}
        conan_cache_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
        path: |
          control_cpp
          minimal_cpp
          monitor_cpp
        cache_paths: |
          ~/.conan2
          control_cpp/out
          minimal_cpp/out
          monitor_cpp/out

  # Builds the Minimal App for RPi
  build_minimal_app_rpi:
    runs-on: CPR_Ubuntu2404
    timeout-minutes: 10
    needs: build_dependencies_rpi

    steps:
    - uses: actions/checkout@v7
      with:
        submodules: true

    - name: Restore cached dependencies
      id: cache
      uses: actions/cache/restore@v5
      with:
        path: |
          ~/.conan2
          control_cpp/out
          minimal_cpp/out
          monitor_cpp/out
        key: conan-${{ runner.os }}-armv8_32-${{ hashFiles('**/conan_linux_rpi.lock', '**/conanfile.py') }}
        fail-on-cache-miss: true

    - name: Install RPi Cross-Compiler
      uses: CommonplaceRobotics/Action_Build_Conan_Dependencies/Install_Toolchain_armv8_32@v2

    - name: Install Conan
      uses: conan-io/setup-conan@v1

    - name: Configure CMake
      run: |
        cd minimal_cpp
        rm -f CMakePresets.json
        echo "{\"version\": 4,\"include\":[\"out/conan/Linux/armv8_32/Release/generators/CMakePresets.json\"]}" >> CMakePresets.json
        cmake --preset conan-linux-armv8_32-release .

    - name: Build for Linux armhf (RPi)
      run: |
        cd minimal_cpp/out/build/Linux/armv8_32/Release
        cmake --build . --target minimalapp

    - name: Package App
      run: |
        cd minimal_cpp
        mkdir -p package/minimal_cpp
        cp rcapp.xml ui.xml Licenses*.pdf package/minimal_cpp
        cp out/build/Linux/armv8_32/Release/minimalapp package/minimal_cpp
        cd package

    - name: Export binary
      uses: actions/upload-artifact@v7
      with:
        name: minimal_app_rpi.zip
        path: minimal_cpp/package


  # Builds the Monitor App for RPi
  build_monitor_app_rpi:
    runs-on: CPR_Ubuntu2404
    timeout-minutes: 10
    needs: build_dependencies_rpi

    steps:
    - uses: actions/checkout@v7
      with:
        submodules: true

    - name: Restore cached dependencies
      id: cache
      uses: actions/cache/restore@v5
      with:
        path: |
          ~/.conan2
          control_cpp/out
          minimal_cpp/out
          monitor_cpp/out
        key: conan-${{ runner.os }}-armv8_32-${{ hashFiles('**/conan_linux_rpi.lock', '**/conanfile.py') }}
        fail-on-cache-miss: true

    - name: Install RPi Cross-Compiler
      uses: CommonplaceRobotics/Action_Build_Conan_Dependencies/Install_Toolchain_armv8_32@v2

    - name: Install Conan
      uses: conan-io/setup-conan@v1

    - name: Configure CMake
      run: |
        cd monitor_cpp
        rm -f CMakePresets.json
        echo "{\"version\": 4,\"include\":[\"out/conan/Linux/armv8_32/Release/generators/CMakePresets.json\"]}" >> CMakePresets.json
        cmake --preset conan-linux-armv8_32-release .

    - name: Build for Linux armhf (RPi)
      run: |
        cd monitor_cpp/out/build/Linux/armv8_32/Release
        cmake --build . --target monitorapp

    - name: Package App
      run: |
        cd monitor_cpp
        mkdir -p package/monitor_cpp
        cp rcapp.xml ui.xml Licenses*.pdf package/monitor_cpp
        cp out/build/Linux/armv8_32/Release/monitorapp package/monitor_cpp
        cd package

    - name: Export binary
      uses: actions/upload-artifact@v7
      with:
        name: monitor_app_rpi.zip
        path: monitor_cpp/package


  # Builds the Control App for RPi
  build_control_app_rpi:
    runs-on: CPR_Ubuntu2404
    timeout-minutes: 10
    needs: build_dependencies_rpi

    steps:
    - uses: actions/checkout@v7
      with:
        submodules: true

    - name: Restore cached dependencies
      id: cache
      uses: actions/cache/restore@v5
      with:
        path: |
          ~/.conan2
          control_cpp/out
          minimal_cpp/out
          monitor_cpp/out
        key: conan-${{ runner.os }}-armv8_32-${{ hashFiles('**/conan_linux_rpi.lock', '**/conanfile.py') }}
        fail-on-cache-miss: true

    - name: Install RPi Cross-Compiler
      uses: CommonplaceRobotics/Action_Build_Conan_Dependencies/Install_Toolchain_armv8_32@v2

    - name: Install Conan
      uses: conan-io/setup-conan@v1

    - name: Configure CMake
      run: |
        cd control_cpp
        rm -f CMakePresets.json
        echo "{\"version\": 4,\"include\":[\"out/conan/Linux/armv8_32/Release/generators/CMakePresets.json\"]}" >> CMakePresets.json
        cmake --preset conan-linux-armv8_32-release .

    - name: Build for Linux armhf (RPi)
      run: |
        cd control_cpp/out/build/Linux/armv8_32/Release
        cmake --build . --target controlapp

    - name: Package App
      run: |
        cd control_cpp
        mkdir -p package/control_cpp
        cp rcapp.xml ui.xml Licenses*.pdf SampleProgram.xml package/control_cpp
        cp out/build/Linux/armv8_32/Release/controlapp package/control_cpp
        cd package

    - name: Export binary
      uses: actions/upload-artifact@v7
      with:
        name: control_app_rpi.zip
        path: control_cpp/package


  # Erstellt die SBOMs, prüft ihre Compliance und führt einen Schwachstellenscan durch
  sbom:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [build_minimal_app_rpi, build_monitor_app_rpi, build_control_app_rpi]

    steps:
    - uses: actions/checkout@v7
      with:
        submodules: true

    - name: Get the SBOM enrichment tool
      uses: actions/checkout@v7
      with:
        repository: CommonplaceRobotics/SW_SBOM_Enrichment
        path: ${{ github.workspace }}/sbom_tool

    - name: Get the MinimalApp binaries
      uses: actions/download-artifact@v8
      with:
        name: minimal_app_rpi.zip
        skip-decompress: true

    - name: Get the MonitorApp binaries
      uses: actions/download-artifact@v8
      with:
        name: monitor_app_rpi.zip
        skip-decompress: true

    - name: Get the ControlApp binaries
      uses: actions/download-artifact@v8
      with:
        name: control_app_rpi.zip
        skip-decompress: true

    - name: Restore cached dependencies
      id: cache
      uses: actions/cache/restore@v5
      with:
        path: |
          ~/.conan2
          control_cpp/out
          minimal_cpp/out
          monitor_cpp/out
        key: conan-${{ runner.os }}-armv8_32-${{ hashFiles('**/conan_linux_rpi.lock', '**/conanfile.py') }}
        fail-on-cache-miss: true

    - name: Install RPi Cross-Compiler
      uses: CommonplaceRobotics/Action_Build_Conan_Dependencies/Install_Toolchain_armv8_32@v1

    - name: Install Conan
      uses: conan-io/setup-conan@v1

    # This generates sbomify.json with lifecycle info
    - name: Configure CMake for MinimalApp
      run: |
        cd minimal_cpp
        rm -f CMakePresets.json
        echo "{\"version\": 4,\"include\":[\"out/conan/Linux/armv8_32/Release/generators/CMakePresets.json\"]}" >> CMakePresets.json
        cmake --preset conan-linux-armv8_32-release
        mv out/build/Linux/armv8_32/Release/sbomify.json .

    # This generates sbomify.json with lifecycle info
    - name: Configure CMake for MonitorApp
      run: |
        cd monitor_cpp
        rm -f CMakePresets.json
        echo "{\"version\": 4,\"include\":[\"out/conan/Linux/armv8_32/Release/generators/CMakePresets.json\"]}" >> CMakePresets.json
        cmake --preset conan-linux-armv8_32-release
        mv out/build/Linux/armv8_32/Release/sbomify.json .

    # This generates sbomify.json with lifecycle info
    - name: Configure CMake for ControlApp
      run: |
        cd control_cpp
        rm -f CMakePresets.json
        echo "{\"version\": 4,\"include\":[\"out/conan/Linux/armv8_32/Release/generators/CMakePresets.json\"]}" >> CMakePresets.json
        cmake --preset conan-linux-armv8_32-release
        mv out/build/Linux/armv8_32/Release/sbomify.json .

    # Liest die Core-Version aus CMakeLists.txt
    - name: Get software versions
      run: |
        MINIMAL_APP_VER=`grep -E -o "VERSION[[:blank:]]+[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" minimal_cpp/CMakeLists.txt | sed "s/[^0-9.]*//g"`
        MONITOR_APP_VER=`grep -E -o "VERSION[[:blank:]]+[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" monitor_cpp/CMakeLists.txt | sed "s/[^0-9.]*//g"`
        CONTROL_APP_VER=`grep -E -o "VERSION[[:blank:]]+[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" control_cpp/CMakeLists.txt | sed "s/[^0-9.]*//g"`
        echo "Minimal App version '$MINIMAL_APP_VER' detected"
        echo "Monitor App version '$MONITOR_APP_VER' detected"
        echo "Control App version '$CONTROL_APP_VER' detected"
        echo "MINIMAL_APP_VER=$MINIMAL_APP_VER" >> $GITHUB_ENV
        echo "MONITOR_APP_VER=$MONITOR_APP_VER" >> $GITHUB_ENV
        echo "CONTROL_APP_VER=$CONTROL_APP_VER" >> $GITHUB_ENV

    - name: Create output directories
      run: mkdir sboms sboms_temp

    - name: Create incomplete SBOM for Minimal App
      uses: CommonplaceRobotics/Action_Create_Conan_SBOM@v4
      with:
        workdir: minimal_cpp
        lockfile: conan_linux_rpi.lock
        sbom: sbom_temp1.cdx.json
        conan_params: '--profile:host=cpr_linux_rpi4_gcc10_release --profile:build=cpr_linux_x86_64_release'

    - name: Create incomplete SBOM for Monitor App
      uses: CommonplaceRobotics/Action_Create_Conan_SBOM@v4
      with:
        workdir: monitor_cpp
        lockfile: conan_linux_rpi.lock
        sbom: sbom_temp1.cdx.json
        conan_params: '--profile:host=cpr_linux_rpi4_gcc10_release --profile:build=cpr_linux_x86_64_release'

    - name: Create incomplete SBOM for Control App
      uses: CommonplaceRobotics/Action_Create_Conan_SBOM@v4
      with:
        workdir: control_cpp
        lockfile: conan_linux_rpi.lock
        sbom: sbom_temp1.cdx.json
        conan_params: '--profile:host=cpr_linux_rpi4_gcc10_release --profile:build=cpr_linux_x86_64_release'

    - name: Create SBOM for MinimalApp
      uses: sbomify/sbomify-action@master
      env:
        WORKING_DIR: minimal_cpp
        SBOM_FILE: sbom_temp1.cdx.json
        OUTPUT_FILE: ../sboms_temp/sbom_minimal_app_cpp.cdx.json
        COMPONENT_NAME: Minimal_App_CPP
        COMPONENT_VERSION: ${{ env.MINIMAL_APP_VER }}
        # Produkt- und Firmeninfo werden aus sbomify.json geladen
        AUGMENT: true
        # Metadaten aus Paket-Registry hinzufügen
        ENRICH: true
        UPLOAD: false

    - name: Create SBOM for MonitorApp
      uses: sbomify/sbomify-action@master
      env:
        WORKING_DIR: monitor_cpp
        SBOM_FILE: sbom_temp1.cdx.json
        OUTPUT_FILE: ../sboms_temp/sbom_monitor_app_cpp.cdx.json
        COMPONENT_NAME: Monitor_App_CPP
        COMPONENT_VERSION: ${{ env.MONITOR_APP_VER }}
        # Produkt- und Firmeninfo werden aus sbomify.json geladen
        AUGMENT: true
        # Metadaten aus Paket-Registry hinzufügen
        ENRICH: true
        UPLOAD: false

    - name: Create SBOM for ControlApp
      uses: sbomify/sbomify-action@master
      env:
        WORKING_DIR: control_cpp
        SBOM_FILE: sbom_temp1.cdx.json
        OUTPUT_FILE: ../sboms_temp/sbom_control_app_cpp.cdx.json
        COMPONENT_NAME: Control_App_CPP
        COMPONENT_VERSION: ${{ env.CONTROL_APP_VER }}
        # Produkt- und Firmeninfo werden aus sbomify.json geladen
        AUGMENT: true
        # Metadaten aus Paket-Registry hinzufügen
        ENRICH: true
        UPLOAD: false

    - name: Final SBOM enrichment for Minimal App
      uses: CommonplaceRobotics/Action_SBOM_Enrichment@v9
      with:
        database: .github/workflows/sbom_enrichment_db.json
        sbom: sboms_temp/sbom_minimal_app_cpp.cdx.json
        sbom_out: sboms/sbom_minimal_app_cpp.cdx.json
        cmake_build_dir: minimal_cpp/out/build/Linux/armv8_32/Release

    - name: Final SBOM enrichment for Monitor App
      uses: CommonplaceRobotics/Action_SBOM_Enrichment@v9
      with:
        database: .github/workflows/sbom_enrichment_db.json
        sbom: sboms_temp/sbom_monitor_app_cpp.cdx.json
        sbom_out: sboms/sbom_monitor_app_cpp.cdx.json
        cmake_build_dir: monitor_cpp/out/build/Linux/armv8_32/Release

    - name: Final SBOM enrichment for Control App
      uses: CommonplaceRobotics/Action_SBOM_Enrichment@v9
      with:
        database: .github/workflows/sbom_enrichment_db.json
        sbom: sboms_temp/sbom_control_app_cpp.cdx.json
        sbom_out: sboms/sbom_control_app_cpp.cdx.json
        cmake_build_dir: control_cpp/out/build/Linux/armv8_32/Release

    - name: Export SBOMs
      uses: actions/upload-artifact@v7
      with:
        name: sboms
        path: sboms
        archive: true

    - name: Validate SBOM with company policies (Minimal App)
      uses: CommonplaceRobotics/Action_Validate_SBOM@v6
      with:
        sbom: sboms/sbom_minimal_app_cpp.cdx.json

    - name: Validate SBOM with company policies (Monitor App)
      uses: CommonplaceRobotics/Action_Validate_SBOM@v6
      with:
        sbom: sboms/sbom_monitor_app_cpp.cdx.json

    - name: Validate SBOM with company policies (Control App)
      uses: CommonplaceRobotics/Action_Validate_SBOM@v6
      with:
        sbom: sboms/sbom_control_app_cpp.cdx.json