Merge branch 'main' into es/06-12-chore_remove_deprecated_extensions_commands

Author: eseliger

.github/workflows/goreleaser.yml

@@ -202,7 +202,7 @@ jobs:
           args: release --clean --config=${{ env.config_file }}
         env:
           # Use separate access token, because we need a scope:repo token to publish the brew formula.
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ secrets.BOT_CROSS_REPO_PAT }}
 
   # goreleaser_post updates the symlink name to refer to the new release version. The
   # symlink enables users to install the latest src-cli with the versioned command:

CHANGELOG.md

@@ -11,8 +11,20 @@ All notable changes to `src-cli` are documented in this file.
 
 ## Unreleased
 
+### Added
+
+- SBOM support: Added `--image` and `--exclude-image` flags to `src sbom fetch` for filtering which docker images SBOMs are fetched for. Both flags support glob patterns (e.g., `frontend`, `*api*`) and comma-separated lists. The `sourcegraph/` image name prefix is optional.
+
+### Changed
+
 - The deprecated `src extensions` commands have been removed.
 
+## 6.4.0
+
+## 6.3.0
+
+## 6.2.0
+
 ## 6.1.1
 
 ### Added
@@ -24,6 +36,7 @@ All notable changes to `src-cli` are documented in this file.
 - Updated Go to 1.24.1
 
 ## 6.1.0
+
 - Support uploading GZIP compressed SCIP indexes [1146](https://github.com/sourcegraph/src-cli/pull/1146)
 - Remove deprecated `lsif` subcommand, and remove LSIF->SCIP conversion support [1147](https://github.com/sourcegraph/src-cli/pull/1147)
 
@@ -40,6 +53,7 @@ All notable changes to `src-cli` are documented in this file.
 - Update x/crypto to fix reported CVE-2024-45337
 
 ## 5.10.0
+
 - cody gateway benchmark changes
 - fix local builds for non sourcegraph team [1121](https://github.com/sourcegraph/src-cli/pull/1121)
 
@@ -80,7 +94,7 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Added
 
-- Batch Changes: Added support for batch spec versions. Batch specs with `version: 2` will default to keyword search to resolve workspaces if the pattern type is not specified explicitly.  (https://github.com/sourcegraph/sourcegraph/pull/63613)
+- Batch Changes: Added support for batch spec versions. Batch specs with `version: 2` will default to keyword search to resolve workspaces if the pattern type is not specified explicitly.  (<https://github.com/sourcegraph/sourcegraph/pull/63613>)
 
 ### Changed
 
@@ -147,11 +161,13 @@ All notable changes to `src-cli` are documented in this file.
 ## 5.1.0
 
 ### Added
+
 - `src validate install` can check executor connections [#974](https://github.com/sourcegraph/src-cli/pull/974)
 - `src validate install` can send test SMTP message [#973](https://github.com/sourcegraph/src-cli/pull/973)
 - `src repos {add|update|delete}-metadata -repo-name` flag support [#977](https://github.com/sourcegraph/src-cli/pull/977)
 
 ### Changed
+
 - Renamed `src repo {add|update|delete}-kvp` to `repo {add|update|delete}-metadata` [#972](https://github.com/sourcegraph/src-cli/pull/972)
 
 ## 5.0.3
@@ -192,7 +208,7 @@ No noteworthy changes, mechanical release to match Sourcegraph release.
 
 ### Fixed
 
--  `src codeintel upload` will no longer overwrite the entire route supplied via `-upload-route` if SCIP data is detected. [#934](https://github.com/sourcegraph/src-cli/pull/934)
+- `src codeintel upload` will no longer overwrite the entire route supplied via `-upload-route` if SCIP data is detected. [#934](https://github.com/sourcegraph/src-cli/pull/934)
 
 ## 4.4.1
 
@@ -238,7 +254,7 @@ No noteworthy changes, mechanical release to match Sourcegraph release.
 ### Added
 
 - Batch specs being run locally with `src batch preview` or `src batch apply` can now be run with the `-run-as-root` flag, which will run all step containers as root instead of the default user for the image. This is off by default. [#886](https://github.com/sourcegraph/src-cli/pull/886)
-- An **experimental** set of `src snapshot` commands for generating and sharing snapshots of Sourcegraph instances, as well as testing Sourcegraph instances restored from snapshots. [#888](https://github.com/sourcegraph/src-cli/pull/888), [#889](https://github.com/sourcegraph/src-cli/pull/889), [#890](https://github.com/sourcegraph/src-cli/pull/890)
+- An __experimental__ set of `src snapshot` commands for generating and sharing snapshots of Sourcegraph instances, as well as testing Sourcegraph instances restored from snapshots. [#888](https://github.com/sourcegraph/src-cli/pull/888), [#889](https://github.com/sourcegraph/src-cli/pull/889), [#890](https://github.com/sourcegraph/src-cli/pull/890)
 
 ### Changed
 
@@ -312,7 +328,7 @@ No noteworthy changes, mechanical release to match Sourcegraph release.
 
 ### Changed
 
-- **IMPORTANT:** Searches using the command `src search -stream` is updated to use a **new and better search result schema**, improving highlighting and accurate result counts for multiline matches. Please see the new JSON schema for results if you use the `src search -stream -json` output: [#807](https://github.com/sourcegraph/src-cli/pull/807)
+- __IMPORTANT:__ Searches using the command `src search -stream` is updated to use a __new and better search result schema__, improving highlighting and accurate result counts for multiline matches. Please see the new JSON schema for results if you use the `src search -stream -json` output: [#807](https://github.com/sourcegraph/src-cli/pull/807)
 
 ### Fixed
 
@@ -935,7 +951,7 @@ Re-release of 3.29.3 for Sourcegraph 3.30.
 ### Changed
 
 - `src campaign [apply|preview]` now prints more detailed information about the diffs produced in each repository when run in verbose mode with `-v`. [#390](https://github.com/sourcegraph/src-cli/pull/390)
-- The dependency `go-diff` has been upgraded to 0.6.1 to include https://github.com/sourcegraph/go-diff/pull/55.
+- The dependency `go-diff` has been upgraded to 0.6.1 to include <https://github.com/sourcegraph/go-diff/pull/55>.
 
 ## 3.22.2
 

DEVELOPMENT.md

@@ -83,7 +83,7 @@ We adhere to the [general Sourcegraph principles for testing](https://docs.sourc
         [...]
         ```
         After updating the checksums, rerun the command to verify that the values are correct.
-    4. Run `sg generate bazel` (this may not result in any changes)
+    4. Run `sg generate bazel` and `sg bazel configure` (this may not result in any changes)
     4. Commit the changes, and open a PR.
  6. Once the version bump PR is merged and the commit is live on dotcom, check that the [curl commands in the README](README.md#installation) also fetch the new latest version.
 

cmd/src/main.go

@@ -60,6 +60,7 @@ The commands are:
 	repos,repo      manages repositories
 	sbom            manages SBOM (Software Bill of Materials) data
 	search          search for results on Sourcegraph
+	search-jobs     manages search jobs
 	serve-git       serves your local git repositories over HTTP for Sourcegraph to pull
 	users,user      manages users
 	codeowners      manages code ownership information

cmd/src/sbom_fetch.go

@@ -25,20 +25,32 @@ func init() {
 
 Usage:
 
-    src sbom fetch -v <version>
+    src sbom fetch -v <version> [--image <image-patterns>] [--exclude-image <exclude-patterns>]
 
 Examples:
 
-    $ src sbom fetch -v 5.8.0                            # Fetch all SBOMs for the 5.8.0 release
+    $ src sbom fetch -v 5.8.0                              # Fetch all SBOMs for the 5.8.0 release
 
-    $ src sbom fetch -v 5.8.123 -internal -d /tmp/sboms  # Fetch all SBOMs for the internal 5.8.123 release and store them in /tmp/sboms
+    $ src sbom fetch -v 5.8.0 --image frontend             # Fetch SBOM only for the frontend image
+
+    $ src sbom fetch -v 5.8.0 --image "redis*"             # Fetch SBOMs for all images with names beginning with 'redis'
+
+    $ src sbom fetch -v 5.8.0 --image "frontend,redis*"    # Fetch SBOMs for frontend, and all redis images
+
+    $ src sbom fetch -v 5.8.0 --exclude-image "sg,*redis*" # Fetch SBOMs for all images, except sg and redis
+
+    $ src sbom fetch -v 5.8.0 --image "postgres*" --exclude-image "*exporter*" # Fetch SBOMs for all postgres images, except exporters
+
+    $ src sbom fetch -v 5.8.123 -internal -d /tmp/sboms    # Fetch all SBOMs for the internal 5.8.123 release and store them in /tmp/sboms
 `
 
 	flagSet := flag.NewFlagSet("fetch", flag.ExitOnError)
 	versionFlag := flagSet.String("v", "", "The version of Sourcegraph to fetch SBOMs for.")
 	outputDirFlag := flagSet.String("d", "sourcegraph-sboms", "The directory to store validated SBOMs in.")
 	internalReleaseFlag := flagSet.Bool("internal", false, "Fetch SBOMs for an internal release. Defaults to false.")
 	insecureIgnoreTransparencyLogFlag := flagSet.Bool("insecure-ignore-tlog", false, "Disable transparency log verification. Defaults to false.")
+	imageFlag := flagSet.String("image", "", "Filter list of image names, to only fetch SBOMs for Docker images with names matching these patterns. Supports literal names, like frontend, and glob patterns like '*postgres*'. Multiple patterns can be specified as a comma-separated list (e.g., 'frontend,*postgres-1?-*'). The 'sourcegraph/' prefix is optional. If not specified, SBOMs for all images are fetched.")
+	excludeImageFlag := flagSet.String("exclude-image", "", "Exclude Docker images with names matching these patterns from being fetched. Supports the same formats as --image. Takes precedence over --image filters.")
 
 	handler := func(args []string) error {
 		c := cosignConfig{
@@ -73,6 +85,24 @@ Examples:
 			c.insecureIgnoreTransparencyLog = true
 		}
 
+		if imageFlag != nil && *imageFlag != "" {
+			// Parse comma-separated patterns
+			patterns := strings.Split(*imageFlag, ",")
+			for i, pattern := range patterns {
+				patterns[i] = strings.TrimSpace(pattern)
+			}
+			c.imageFilters = patterns
+		}
+
+		if excludeImageFlag != nil && *excludeImageFlag != "" {
+			// Parse comma-separated exclude patterns
+			patterns := strings.Split(*excludeImageFlag, ",")
+			for i, pattern := range patterns {
+				patterns[i] = strings.TrimSpace(pattern)
+			}
+			c.excludeImageFilters = patterns
+		}
+
 		out := output.NewOutput(flagSet.Output(), output.OutputOpts{Verbose: *verbose})
 
 		if err := verifyCosign(); err != nil {

cmd/src/sbom_utils.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"os/exec"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"time"
@@ -26,6 +27,8 @@ type cosignConfig struct {
 	version                       string
 	internalRelease               bool
 	insecureIgnoreTransparencyLog bool
+	imageFilters                  []string
+	excludeImageFilters           []string
 }
 
 // TokenResponse represents the JSON response from dockerHub's token service
@@ -251,7 +254,21 @@ func (c cosignConfig) getImageList() ([]string, error) {
 		if image != "" {
 			// Strip off a version suffix if present
 			parts := strings.SplitN(image, ":", 2)
-			images = append(images, parts[0])
+			imageName := parts[0]
+
+			// If the --image arg was provided, and if the image name doesn't match any of the filters
+			// then skip this image
+			if len(c.imageFilters) > 0 && !matchesImageFilter(c.imageFilters, imageName) {
+				continue
+			}
+
+			// If the --exclude-image arg was provided, and if the image name does match any of the filters
+			// then skip this image
+			if len(c.excludeImageFilters) > 0 && matchesImageFilter(c.excludeImageFilters, imageName) {
+				continue
+			}
+
+			images = append(images, imageName)
 		}
 	}
 
@@ -270,3 +287,24 @@ func (c *cosignConfig) getImageReleaseListURL() string {
 		return fmt.Sprintf("%s/release/%s/%s", imageListBaseURL, c.version, imageListFilename)
 	}
 }
+
+// matchesImageFilter checks if the image name from the list of published images
+// matches any user-provided --image or --exclude-image glob patterns
+// It matches against both the full image name, and the image name without the "sourcegraph/" prefix.
+func matchesImageFilter(patterns []string, imageName string) bool {
+	for _, pattern := range patterns {
+		// Try matching against the full image name
+		if matched, _ := filepath.Match(pattern, imageName); matched {
+			return true
+		}
+
+		// Try matching against the image name without "sourcegraph/" prefix
+		if strings.HasPrefix(imageName, "sourcegraph/") {
+			shortName := strings.TrimPrefix(imageName, "sourcegraph/")
+			if matched, _ := filepath.Match(pattern, shortName); matched {
+				return true
+			}
+		}
+	}
+	return false
+}