|
1 | 1 | # Generate SBOM GitHub Action |
2 | 2 |
|
3 | | -This action generates a Software Bill of Materials (SBOM) from git repositories using [Syft](https://github.com/anchore/syft). |
| 3 | +[](https://github.com/scality/sbom/releases/latest) |
| 4 | +[](https://github.com/anchore/sbom-action/blob/main/LICENSE) |
4 | 5 |
|
5 | | -Syft will search in the entire repository and generate a sbom file for each language. |
| 6 | +A GitHub Action for creating a software bill of materials (SBOM) |
| 7 | +using [Syft](https://github.com/anchore/syft). |
6 | 8 |
|
7 | | -Actually, only those languages are supported: |
| 9 | +## Basic Usage |
8 | 10 |
|
9 | | -- python |
10 | | -- go |
11 | | -- javascript |
12 | | -- github-actions |
| 11 | +```yaml |
| 12 | +- uses: scality/sbom@v1 |
| 13 | + with: |
| 14 | + target: ./ |
| 15 | +``` |
13 | 16 |
|
14 | | -If you need to add more syft cataloger, please open an issue. |
| 17 | +This will create SBOM result files based on type, ex: |
15 | 18 |
|
16 | | -## Inputs |
| 19 | +- repo_sbom_v1.1.0-4-gd6cdf1f.json |
| 20 | +- repo_sbom_v1.2.0.json |
| 21 | +- image_nginx_latest.json |
| 22 | +- iso_myiso.iso_128.json |
17 | 23 |
|
18 | | -### `ref` |
| 24 | +If you want to scan a repository, you have to checkout it with `fetch-tags`. |
| 25 | +This is mandatory to get repo version for SBOM filename. |
19 | 26 |
|
20 | | -The git revision to checkout. Default is the current commit SHA. |
| 27 | +```yaml |
| 28 | +- uses: actions/checkout@v4 |
| 29 | + with: |
| 30 | + fetch-depth: 0 |
| 31 | + fetch-tags: true |
| 32 | +``` |
21 | 33 |
|
22 | | -### `repo` |
| 34 | +## Configuration |
23 | 35 |
|
24 | | -The repository to scan. This is required. |
| 36 | +### scality/sbom |
25 | 37 |
|
26 | | -### `input_path` |
| 38 | +The main [SBOM action](action.yml), responsible for generating SBOMs. |
27 | 39 |
|
28 | | -The path to the repository. This is required. |
| 40 | +| Parameter | Description | Default | |
| 41 | +| --------------------------- | ------------------------------------------------------------------------------------- | ---------------------- | |
| 42 | +| `grype-version` | Grype version to use | 0.77.2 | |
| 43 | +| `sfyt-version` | Syft version to use | 1.2.0 | |
| 44 | +| `trivy-version` | Trivy version to use | 0.50.1 | |
| 45 | +| `target` | A file/directory/iso on the filesystem to scan. | \<current directory> | |
| 46 | +| `format` | Format of SBOM file. | cyclonedx-json | |
| 47 | +| `name` | Name of the target, if you need to overwrite the detected. | | |
| 48 | +| `version` | Version of the target, if you need to overwrite the detected. ISO have no version. | | |
| 49 | +| `output_dir` | Path to store generated SBOM files. | /tmp/sbom | |
| 50 | +| `exclude_mediatypes` | Media types to exclude for images. | | |
| 51 | +| `vuln_report` | Generate vuln report using Grype. | | |
29 | 52 |
|
30 | | -### `output_path` |
| 53 | +## Example Usage |
31 | 54 |
|
32 | | -The path to store the SBOM. This is required. |
| 55 | +### Scan with a specific format |
| 56 | + |
| 57 | +Use the `path` parameter, relative to the repository root: |
| 58 | + |
| 59 | +```yaml |
| 60 | +- uses: scality/sbom@v1 |
| 61 | + with: |
| 62 | + target: ./artifacts |
| 63 | + format: cyclonedx-json |
| 64 | +``` |
| 65 | + |
| 66 | +### Exclude mediatypes for container images |
| 67 | + |
| 68 | +Images created with Oras for example have custom mediatype and are not usable |
| 69 | +by Skopeo, they have to be excluded. |
| 70 | + |
| 71 | +```yaml |
| 72 | +- uses: scality/sbom@v1 |
| 73 | + with: |
| 74 | + target: ./images |
| 75 | + exclude_mediatypes: "application/grafana-dashboard+json text/nginx-conf-template" |
| 76 | +``` |
33 | 77 |
|
34 | | -## Example usage |
| 78 | +### Full example |
35 | 79 |
|
36 | 80 | ```yaml |
37 | | -uses: scality/sbom@v1 |
38 | | -with: |
39 | | - ref: ${{ github.sha }} |
40 | | - repo: 'your-repo-to-scan' |
41 | | - input_path: 'path-to-your-repo' |
42 | | - output_path: 'path-to-store-sbom' |
| 81 | +name: "Generate sbom" |
| 82 | +on: |
| 83 | + workflow_dispatch: |
| 84 | + workflow_call: |
| 85 | +jobs: |
| 86 | + generate-sbom: |
| 87 | + runs-on: ubuntu-22.04 |
| 88 | + env: |
| 89 | + BASE_PATH: ${{ github.workspace }}/workdir |
| 90 | + SBOM_PATH: ${{ github.workspace }}/artifacts/sbom |
| 91 | + steps: |
| 92 | + - name: Create directories |
| 93 | + shell: bash |
| 94 | + run: | |
| 95 | + mkdir -p ${{ env.BASE_PATH }}/repo |
| 96 | + mkdir -p ${{ env.BASE_PATH }}/iso |
| 97 | + mkdir -p ${{ env.SBOM_PATH }} |
| 98 | + - name: Checkout repo for scanning |
| 99 | + uses: actions/checkout@v4 |
| 100 | + with: |
| 101 | + fetch-depth: 0 |
| 102 | + fetch-tags: true |
| 103 | + path: ${{ env.BASE_PATH }}/repo/myrepo |
| 104 | + - name: Generate sbom for repository |
| 105 | + uses: scality/sbom@v1.2.0 |
| 106 | + with: |
| 107 | + target: ${{ env.BASE_PATH }}/repo/myrepo |
| 108 | + output-dir: ${{ env.SBOM_PATH }} |
| 109 | + - name: Get artifacts URL |
| 110 | + uses: scality/action-artifacts@v4 |
| 111 | + id: artifacts |
| 112 | + with: |
| 113 | + method: setup |
| 114 | + url: https://artifactmanager.net |
| 115 | + user: ${{ secrets.ARTIFACTS_USER }} |
| 116 | + password: ${{ secrets.ARTIFACTS_PASSWORD }} |
| 117 | + - name: Donwload artifacts |
| 118 | + shell: bash |
| 119 | + env: |
| 120 | + ARTIFACTS_URL: ${{ steps.artifacts.outputs.link }} |
| 121 | + ARTIFACTS_USER: ${{ secrets.ARTIFACTS_USER }} |
| 122 | + ARTIFACTS_PASSWORD: ${{ secrets.ARTIFACTS_PASSWORD }} |
| 123 | + run: | |
| 124 | + echo "Downloading my.iso from $ARTIFACTS_URL" |
| 125 | + curl -sSfL -o ${{ env.BASE_PATH }}/iso/my.iso -u $ARTIFACTS_USER:$ARTIFACTS_PASSWORD $ARTIFACTS_URL/my.iso |
| 126 | + - name: Generate sbom for ISO |
| 127 | + uses: scality/sbom@v1.2.0 |
| 128 | + with: |
| 129 | + target: ${{ env.BASE_PATH }}/iso/my.iso |
| 130 | + version: "1.0.0" # Make sure to replace this with the actual ISO version |
| 131 | + output-dir: ${{ env.SBOM_PATH }} |
| 132 | + - name: Generate archive |
| 133 | + shell: bash |
| 134 | + run: | |
| 135 | + cd ${{ env.SBOM_PATH }} |
| 136 | + tar -czf sbom_myproject.tar.gz *.json |
| 137 | + - name: Clean up |
| 138 | + shell: bash |
| 139 | + run: | |
| 140 | + rm -rf ${{ env.BASE_PATH }}/repo |
| 141 | + rm -rf ${{ env.BASE_PATH }}/iso |
| 142 | + rm -f ${{ env.SBOM_PATH }}/*.json |
| 143 | + - name: Upload artifacts |
| 144 | + if: always() |
| 145 | + uses: scality/action-artifacts@v4 |
| 146 | + with: |
| 147 | + method: upload |
| 148 | + url: https://artifactmanager.net |
| 149 | + user: ${{ secrets.USER }} |
| 150 | + password: ${{ secrets.PASSWORD }} |
| 151 | + source: artifacts |
43 | 152 | ``` |
44 | 153 |
|
45 | 154 | ## References |
|
0 commit comments