adds source uri/sha fields support

actions/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.18 as build-stage
+FROM golang:1.20 as build-stage
 
 RUN apt-get update && apt-get install -y --no-install-recommends upx
 

actions/action.go

@@ -59,6 +59,13 @@ func NewOutputs(uri string, latestVersion *semver.Version, additionalOutputs Out
 	}
 
 	for k, v := range additionalOutputs {
+		if k == "source" {
+			sourceSha256, err := SHA256FromURI(v, mods...)
+			if err != nil {
+				return nil, fmt.Errorf("unable to calculate source sha256\n%w", err)
+			}
+			outputs["source_sha256"] = sourceSha256
+		}
 		outputs[k] = v
 	}
 

actions/tomee-dependency/main.go

@@ -48,6 +48,8 @@ func main() {
 	c := colly.NewCollector()
 
 	versions := make(actions.Versions)
+	sources := make(map[string]string)
+
 	c.OnHTML("a[href]", func(element *colly.HTMLElement) {
 		if p := TomeeVersionPattern.FindStringSubmatch(element.Attr("href")); p != nil {
 			if major == "" || major == p[1] {
@@ -59,6 +61,7 @@ func main() {
 				}
 
 				versions[verKey] = fmt.Sprintf("%s/tomee-%[2]s/apache-tomee-%[2]s-%s.tar.gz", uri, verVal, dist)
+				sources[verKey] = fmt.Sprintf("%s/tomee-%[2]s/tomee-project-%[2]s-source-release.zip", uri, verVal, dist)
 			}
 		}
 	})
@@ -71,8 +74,12 @@ func main() {
 	if err != nil {
 		panic(err)
 	}
+	latestSource := actions.Outputs{}
+	if sources != nil {
+		latestSource["source"] = sources[latestVersion.Original()]
+	}
 
-	o, err := actions.NewOutputs(versions[latestVersion.Original()], latestVersion, nil)
+	o, err := actions.NewOutputs(versions[latestVersion.Original()], latestVersion,  latestSource)
 	if err != nil {
 		panic(err)
 	}

octo/buildpack_dependencies.go

@@ -75,6 +75,8 @@ func ContributeBuildpackDependencies(descriptor Descriptor) ([]Contribution, err
 								"CPE_PATTERN":     d.CPEPattern,
 								"PURL":            "${{ steps.dependency.outputs.purl }}",
 								"PURL_PATTERN":    d.PURLPattern,
+								"SOURCE_URI":      "${{ steps.dependency.outputs.source }}",
+								"SOURCE_SHA256":      "${{ steps.dependency.outputs.source_sha256 }}",
 							},
 						}, {
 							Uses: "peter-evans/create-pull-request@v5",

octo/update-buildpack-dependency.sh

@@ -18,7 +18,9 @@ update-buildpack-dependency \
   --purl-pattern "${PURL_PATTERN:-}" \
   --purl "${PURL:-}" \
   --uri "${URI}" \
-  --sha256 "${SHA256}"
+  --sha256 "${SHA256}" \
+  --source "${SOURCE_URI}" \
+  --source-sha256 "${SOURCE_SHA256}"
 
 git add buildpack.toml
 git checkout -- .