Skip to content

Commit 2792f89

Browse files
Joy-In-CodeJoy-In-Code
authored
Merge branch 'main' into feat/add-qwen-grok-deepseek-support
2 parents 3bffd79 + 519a0a1 commit 2792f89

31 files changed

+707
-173
lines changed

‎.github/workflows/ai-bom-scan.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: AI-BOM Scan (PR)
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: read
8+
pull-requests: write
9+
10+
jobs:
11+
ai-bom:
12+
runs-on: ubuntu-latest
13+
14+
env:
15+
AIBOM_JSON: aibom.json
16+
SUMMARY_JSON: aibom-summary.json
17+
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
22+
# Use the official AI-BOM GitHub Action (faster than pip install)
23+
- name: Run AI-BOM scan (AIBOM JSON)
24+
id: scan
25+
uses: trusera/ai-bom@v3
26+
continue-on-error: true
27+
with:
28+
path: "."
29+
format: "aibom"
30+
output: "${{ env.AIBOM_JSON }}"
31+
# Native policy gate (requested by reviewer)
32+
fail-on: "high"
33+
34+
# Python only for building summary + PR comment
35+
- name: Set up Python
36+
uses: actions/setup-python@v5
37+
with:
38+
python-version: "3.12"
39+
40+
- name: Build summary (pass/fail + counts)
41+
run: |
42+
python - <<'PY'
43+
import json, os
44+
45+
aibom_path = os.environ["AIBOM_JSON"]
46+
out_path = os.environ["SUMMARY_JSON"]
47+
scan_status = os.environ.get("SCAN_STATUS", "PASS")
48+
49+
components = []
50+
51+
try:
52+
with open(aibom_path, "r", encoding="utf-8") as f:
53+
data = json.load(f)
54+
55+
# Best-effort component extraction across likely schemas
56+
if isinstance(data, dict):
57+
components = data.get("components") or data.get("aiComponents") or []
58+
if not isinstance(components, list):
59+
components = []
60+
if not components and isinstance(data.get("results"), dict):
61+
components = data["results"].get("components") or data["results"].get("aiComponents") or []
62+
if not isinstance(components, list):
63+
components = []
64+
65+
except FileNotFoundError:
66+
# Scan step may fail before producing output.
67+
components = []
68+
69+
summary = {
70+
"status": scan_status,
71+
"components_found": len(components),
72+
"policy_gate": "fail-on: high",
73+
"artifact_generated": os.path.exists(aibom_path),
74+
}
75+
76+
with open(out_path, "w", encoding="utf-8") as f:
77+
json.dump(summary, f, indent=2)
78+
79+
print(json.dumps(summary, indent=2))
80+
PY
81+
env:
82+
SCAN_STATUS: ${{ steps.scan.outcome == 'success' && 'PASS' || 'FAIL' }}
83+
84+
- name: Upload AIBOM JSON artifact
85+
uses: actions/upload-artifact@v4
86+
with:
87+
name: ai-bom-results
88+
path: |
89+
${{ env.AIBOM_JSON }}
90+
${{ env.SUMMARY_JSON }}
91+
if-no-files-found: warn
92+
93+
- name: Create PR comment body
94+
id: comment
95+
run: |
96+
python - <<'PY'
97+
import json, os
98+
99+
with open(os.environ["SUMMARY_JSON"], "r", encoding="utf-8") as f:
100+
s = json.load(f)
101+
102+
status = s["status"]
103+
emoji = "✅" if status == "PASS" else "❌"
104+
105+
if s.get("artifact_generated"):
106+
artifact_note = f"Artifact uploaded: `{os.environ['AIBOM_JSON']}`"
107+
else:
108+
artifact_note = "Artifact not generated (scan may have failed before producing output)."
109+
110+
body = f"""### {emoji} AI-BOM Scan Result: **{status}**
111+
112+
- **Components found:** {s["components_found"]}
113+
- **Policy gate:** {s["policy_gate"]}
114+
115+
{artifact_note}
116+
"""
117+
118+
with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as f:
119+
f.write("body<<EOF\n")
120+
f.write(body)
121+
f.write("\nEOF\n")
122+
PY
123+
124+
- name: Post PR comment
125+
uses: peter-evans/create-or-update-comment@v4
126+
with:
127+
issue-number: ${{ github.event.pull_request.number }}
128+
body: ${{ steps.comment.outputs.body }}
129+
edit-mode: replace
130+
131+
# Enforce failure after comment + artifacts (so reviewers still see output)
132+
- name: Fail if policy gate failed
133+
if: steps.scan.outcome != 'success'
134+
run: |
135+
echo "AI-BOM policy gate failed (fail-on: high)."
136+
exit 1
137+

‎.github/workflows/auto-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ jobs:
239239
eval "$BUMP_SCRIPT"
240240
bump_version 'trusera-sdk-go/v*' 'trusera-sdk-go/v' 'trusera-sdk-go/'
241241
242-
- uses: actions/setup-go@v5
242+
- uses: actions/setup-go@v6
243243
if: steps.bump.outputs.skip != 'true'
244244
with: { go-version: "1.21" }
245245

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
<div align="center">
2+
<a href="https://github.com/trusera/ai-bom/actions/workflows/ai-bom-scan.yml">
3+
<img src="https://github.com/trusera/ai-bom/actions/workflows/ai-bom-scan.yml/badge.svg" alt="AI-BOM Scan" />
4+
</a>
25
<img src="https://raw.githubusercontent.com/Trusera/ai-bom/main/assets/logo.png" alt="AI-BOM Logo" width="120" />
36
<br /><br />
47
<h1>AI-BOM</h1>
@@ -17,7 +20,7 @@
1720
<a href="#agent-sdks">SDKs</a>&ensp;&middot;&ensp;
1821
<a href="#n8n-community-node">n8n Node</a>&ensp;&middot;&ensp;
1922
<a href="#cicd-integration">CI/CD</a>&ensp;&middot;&ensp;
20-
<a href="#comparison">Compare</a>&ensp;&middot;&ensp;
23+
<a href="docs/comparison.md">Compare</a>&ensp;&middot;&ensp;
2124
<a href="#architecture">Docs</a>
2225
</div>
2326

@@ -59,8 +62,6 @@ ai-bom scan . -f sarif -o results.sarif
5962
# Fail CI on critical findings
6063
ai-bom scan . --fail-on critical --quiet
6164

62-
63-
6465
<details>
6566
<summary>Alternative: Install in a virtual environment</summary>
6667

@@ -284,8 +285,6 @@ Scan all your n8n workflows for AI security risks — directly inside n8n. One n
284285
3. Activate the workflow
285286
4. Visit `http://your-n8n-url/webhook/trusera`
286287
287-
288-
289288
That's it. The node fetches all workflows, scans them, and serves an interactive HTML dashboard.
290289
291290
### Included Nodes
@@ -309,6 +308,7 @@ That's it. The node fetches all workflows, scans them, and serves an interactive
309308
- Optional password protection (AES-256-GCM encrypted, client-side decryption)
310309
311310
---
311+
> Looking for AI-BOM ecosystem comparisons? See [AI-BOM Tool Comparison](docs/comparison.md).
312312
313313
## Comparison
314314

‎docs/comparison.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# AI-BOM Tool Comparison
2+
3+
This document compares **ai-bom** with other AI Bill of Materials tools currently available in the ecosystem.
4+
5+
The goal is to help users understand feature differences and choose the right tool for their workflow.
6+
7+
---
8+
9+
## Feature Comparison
10+
11+
| Feature | ai-bom | Cisco AIBOM | Snyk AIBOM |
12+
|--------|--------|-------------|-----------|
13+
| License | Apache 2.0 | Apache 2.0 | Proprietary |
14+
| Open Source | Yes | Yes | No |
15+
| Scanners | 13+ (code, cloud, Docker, GitHub Actions, Jupyter, MCP, n8n, etc.) | 1 (Python-focused) | Unknown |
16+
| Output Formats | 9 (Table, JSON, SARIF, SPDX, CycloneDX, CSV, HTML, Markdown, JUnit) | JSON, CSV | Unknown |
17+
| CI/CD Integration | GitHub Action, GitLab CI | No | Yes |
18+
| LLM Enrichment | No | Yes | Early access / limited preview |
19+
| n8n Scanning | Yes | No | No |
20+
| MCP / A2A Detection | Yes | No | No |
21+
| Agent Framework Detection | LangChain, CrewAI, AutoGen, LlamaIndex, Semantic Kernel | Limited | Unknown |
22+
| Binary Model Detection | Yes (.onnx, .pt, .safetensors, etc.) | No | Unknown |
23+
| Policy Enforcement | Cedar policy gate | No | Yes |
24+
| Best For | Multi-framework projects needing multiple formats | Python projects needing LLM enrichment | Existing Snyk customers |
25+
26+
---
27+
28+
## Notes
29+
30+
### ai-bom
31+
32+
- Open-source AI Bill of Materials scanner focused on discovering AI/LLM usage across codebases and infrastructure.
33+
- Supports multiple scanners, formats, and compliance mappings (OWASP Agentic Top 10, EU AI Act).
34+
- Designed for developer workflows with CLI, CI/CD, and dashboard support.
35+
36+
### Cisco AIBOM
37+
38+
- Open-source tool focused primarily on Python projects.
39+
- Uses LLM-based enrichment to extract model usage.
40+
- Limited scanner coverage and output formats compared to ai-bom.
41+
42+
### Snyk AIBOM
43+
44+
- Proprietary feature integrated into the Snyk platform.
45+
- Currently in early access / limited preview.
46+
- Provides CI/CD integration.
47+
- Public documentation on supported scanners and formats is limited.
48+
49+
---
50+
51+
_Last updated: 2026_

‎docs/docs/assets/demo-output.png‎

784 KB
Loading

0 commit comments

Comments
 (0)