Skip to content

Commit 687e00a

Browse files
sathiya-nhssathiya-nhs
committed
Add sbom-test workflow
1 parent a11397a commit 687e00a

File tree

1 file changed

+129
-71
lines changed

1 file changed

+129
-71
lines changed

‎.github/workflows/sbom.yml‎

Lines changed: 129 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -11,100 +11,158 @@ on:
1111
- yes
1212
- no
1313

14-
env:
15-
SYFT_VERSION: "1.27.1"
16-
TF_VERSION: "1.12.2"
14+
# env:
15+
# SYFT_VERSION: "1.27.1"
16+
# TF_VERSION: "1.12.2"
17+
18+
# jobs:
19+
# deploy:
20+
# name: Software Bill of Materials
21+
# runs-on: ubuntu-latest
22+
# permissions:
23+
# actions: read
24+
# contents: write
25+
# steps:
26+
# - name: Checkout
27+
# uses: actions/checkout@v5
28+
29+
# - name: Setup Python 3.13
30+
# uses: actions/setup-python@v5
31+
# with:
32+
# python-version: "3.13"
33+
34+
# - name: Setup Terraform
35+
# uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
36+
37+
# - uses: terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6
38+
# name: Setup TFLint
39+
40+
# - name: Set architecture variable
41+
# id: os-arch
42+
# run: |
43+
# case "${{ runner.arch }}" in
44+
# X64) ARCH="amd64" ;;
45+
# ARM64) ARCH="arm64" ;;
46+
# esac
47+
# echo "arch=${ARCH}" >> $GITHUB_OUTPUT
48+
49+
# - name: Download and setup Syft
50+
# run: |
51+
# DOWNLOAD_URL="https://github.com/anchore/syft/releases/download/v${{ env.SYFT_VERSION }}/syft_${{ env.SYFT_VERSION }}_linux_${{ steps.os-arch.outputs.arch }}.tar.gz"
52+
# echo "Downloading: ${DOWNLOAD_URL}"
53+
54+
# curl -L -o syft.tar.gz "${DOWNLOAD_URL}"
55+
# tar -xzf syft.tar.gz
56+
# chmod +x syft
57+
58+
# # Add to PATH for subsequent steps
59+
# echo "$(pwd)" >> $GITHUB_PATH
60+
61+
# - name: Create SBOM
62+
# run: bash scripts/create-sbom.sh terraform python tflint
63+
64+
# - name: Convert SBOM JSON to CSV
65+
# run: |
66+
# pip install --upgrade pip
67+
# pip install tabulate
68+
# REPO_NAME=$(basename $GITHUB_REPOSITORY)
69+
# python .github/scripts/sbom_json_to_csv.py sbom.json SBOM_${REPO_NAME}.csv
70+
71+
# - name: Upload SBOM CSV as artifact
72+
# uses: actions/upload-artifact@v4
73+
# with:
74+
# name: sbom-csv
75+
# path: SBOM_${{ github.event.repository.name }}.csv
76+
77+
# - name: Install Grype
78+
# run: |
79+
# curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
80+
81+
# - name: Scan SBOM for Vulnerabilities (JSON)
82+
# run: |
83+
# grype sbom:sbom.json -o json > grype-report.json
84+
85+
1786

18-
jobs:
19-
deploy:
20-
name: Software Bill of Materials
21-
runs-on: ubuntu-latest
22-
permissions:
23-
actions: read
24-
contents: write
25-
steps:
26-
- name: Checkout
27-
uses: actions/checkout@v5
87+
# - name: Convert Grype JSON to CSV
88+
# run: |
89+
# pip install --upgrade pip
90+
# REPO_NAME=$(basename $GITHUB_REPOSITORY)
91+
# python .github/scripts/grype_json_to_csv.py grype-report.json grype-report-${REPO_NAME}.csv
2892

29-
- name: Setup Python 3.13
30-
uses: actions/setup-python@v5
31-
with:
32-
python-version: "3.13"
3393

34-
- name: Setup Terraform
35-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
94+
# - name: Upload Vulnerability Report
95+
# uses: actions/upload-artifact@v4
96+
# with:
97+
# name: grype-report
98+
# path: grype-report-${{ github.event.repository.name }}.csv
3699

37-
- uses: terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6
38-
name: Setup TFLint
100+
# - name: Generate Package Inventory CSV
101+
# run: |
102+
# pip install --upgrade pip
103+
# REPO_NAME=$(basename $GITHUB_REPOSITORY)
104+
# python .github/scripts/sbom_packages_to_csv.py sbom.json $REPO_NAME
39105

40-
- name: Set architecture variable
41-
id: os-arch
42-
run: |
43-
case "${{ runner.arch }}" in
44-
X64) ARCH="amd64" ;;
45-
ARM64) ARCH="arm64" ;;
46-
esac
47-
echo "arch=${ARCH}" >> $GITHUB_OUTPUT
106+
# - name: Upload Package Inventory CSV
107+
# uses: actions/upload-artifact@v4
108+
# with:
109+
# name: sbom-packages
110+
# path: sbom-packages-${{ github.event.repository.name }}.csv
48111

49-
- name: Download and setup Syft
50-
run: |
51-
DOWNLOAD_URL="https://github.com/anchore/syft/releases/download/v${{ env.SYFT_VERSION }}/syft_${{ env.SYFT_VERSION }}_linux_${{ steps.os-arch.outputs.arch }}.tar.gz"
52-
echo "Downloading: ${DOWNLOAD_URL}"
112+
jobs:
113+
sbom:
114+
runs-on: ubuntu-22.04
115+
container:
116+
image: python:3.13-slim
53117

54-
curl -L -o syft.tar.gz "${DOWNLOAD_URL}"
55-
tar -xzf syft.tar.gz
56-
chmod +x syft
118+
steps:
119+
- name: Checkout
120+
uses: actions/checkout@v4
57121

58-
# Add to PATH for subsequent steps
59-
echo "$(pwd)" >> $GITHUB_PATH
122+
- name: Install Poetry and Tools
123+
run: |
124+
apt-get update && apt-get install -y curl
125+
curl -sSL https://install.python-poetry.org | python3 -
126+
export PATH="$HOME/.local/bin:$PATH"
127+
pip install cyclonedx-bom grype tabulate
60128
61-
- name: Create SBOM
62-
run: bash scripts/create-sbom.sh terraform python tflint
129+
- name: Install dependencies
130+
run: |
131+
export PATH="$HOME/.local/bin:$PATH"
132+
poetry install
63133
134+
# Generate SBOM in JSON
135+
- name: Generate SBOM (CycloneDX)
136+
run: |
137+
cyclonedx-py --format json --output sbom.json
138+
139+
# Convert SBOM JSON to CSV
64140
- name: Convert SBOM JSON to CSV
65141
run: |
66-
pip install --upgrade pip
67-
pip install tabulate
68-
REPO_NAME=$(basename $GITHUB_REPOSITORY)
69-
python .github/scripts/sbom_json_to_csv.py sbom.json SBOM_${REPO_NAME}.csv
142+
python .github/scripts/sbom_json_to_csv.py sbom.json sbom.csv
70143
71-
- name: Upload SBOM CSV as artifact
144+
- name: Upload SBOM artifacts
72145
uses: actions/upload-artifact@v4
73146
with:
74-
name: sbom-csv
75-
path: SBOM_${{ github.event.repository.name }}.csv
76-
77-
- name: Install Grype
78-
run: |
79-
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
147+
name: sbom-files
148+
path: |
149+
sbom.json
150+
sbom.csv
80151
81-
- name: Scan SBOM for Vulnerabilities (JSON)
152+
# Scan SBOM for vulnerabilities
153+
- name: Scan SBOM for Vulnerabilities
82154
run: |
83155
grype sbom:sbom.json -o json > grype-report.json
84-
85-
86156
157+
# Convert Grype JSON to CSV
87158
- name: Convert Grype JSON to CSV
88159
run: |
89-
pip install --upgrade pip
90-
REPO_NAME=$(basename $GITHUB_REPOSITORY)
91-
python .github/scripts/grype_json_to_csv.py grype-report.json grype-report-${REPO_NAME}.csv
92-
160+
python .github/scripts/grype_json_to_csv.py grype-report.json grype-report.csv
93161
94162
- name: Upload Vulnerability Report
95163
uses: actions/upload-artifact@v4
96164
with:
97165
name: grype-report
98-
path: grype-report-${{ github.event.repository.name }}.csv
99-
100-
- name: Generate Package Inventory CSV
101-
run: |
102-
pip install --upgrade pip
103-
REPO_NAME=$(basename $GITHUB_REPOSITORY)
104-
python .github/scripts/sbom_packages_to_csv.py sbom.json $REPO_NAME
105-
106-
- name: Upload Package Inventory CSV
107-
uses: actions/upload-artifact@v4
108-
with:
109-
name: sbom-packages
110-
path: sbom-packages-${{ github.event.repository.name }}.csv
166+
path: |
167+
grype-report.json
168+
grype-report.csv

0 commit comments

Comments
 (0)