Skip to content

Commit d39ae4a

Browse files
harmwharmw
authored
Support SBOM input for scanning (#154)
1 parent 8e8448f commit d39ae4a

File tree

7 files changed

+2066
-17
lines changed

7 files changed

+2066
-17
lines changed

‎.github/workflows/demo.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,13 @@ jobs:
2323
debug: true
2424
severity-cutoff: "negligible"
2525
fail-build: false
26+
27+
sbom:
28+
runs-on: ubuntu-latest
29+
steps:
30+
- uses: actions/checkout@v2
31+
- uses: ./
32+
with:
33+
sbom: tests/fixtures/test_sbom.spdx.json
34+
debug: true
35+
fail-build: false

‎README.md‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,23 @@ To scan a directory, add the following step:
7272
7373
The `path` key allows any valid path for the current project. The root of the path (`"."` in this example) is the repository root.
7474

75+
## Scanning an SBOM file
76+
77+
Use the `sbom` key to scan an SBOM file:
78+
79+
```yaml
80+
- name: Create SBOM
81+
uses: anchore/sbom-action@v0
82+
with:
83+
format: spdx-json
84+
output-file: "${{ github.event.repository.name }}-sbom.spdx.json"
85+
86+
- name: Scan SBOM
87+
uses: anchore/scan-action@v3
88+
with:
89+
sbom: "${{ github.event.repository.name }}-sbom.spdx.json"
90+
```
91+
7592
## Failing a build on vulnerability severity
7693

7794
By default, if any vulnerability at `medium` or higher is seen, the build fails. To have the build step fail in cases where there are vulnerabilities with a severity level different than the default, set the `severity-cutoff` field to one of `low`, `high`, or `critical`:
@@ -99,12 +116,13 @@ Optionally, change the `fail-build` field to `false` to avoid failing the build
99116

100117
### Action Inputs
101118

102-
The only required key is `image` or `path`; all the other keys are optional. These are all the available keys to configure this action, along with its defaults:
119+
The inputs `image`, `path`, and `sbom` are mutually exclusive to specify the source to scan; all the other keys are optional. These are all the available keys to configure this action, along with the defaults:
103120

104121
| Input Name | Description | Default Value |
105122
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
106-
| `image` | The image to scan, this is mutually exclusive to `path` | N/A |
107-
| `path` | The file path to scan, this is mutually exclusive to `image` | N/A |
123+
| `image` | The image to scan | N/A |
124+
| `path` | The file path to scan | N/A |
125+
| `sbom` | The SBOM to scan | N/A |
108126
| `debug` | Verbose logging output | `false` |
109127
| `fail-build` | Fail the build if a vulnerability is found with a higher severity. That severity defaults to `"medium"` and can be set with `severity-cutoff`. | `true` |
110128
| `acs-report-enable` | Generate a SARIF report and set the `sarif` output parameter after successful action execution. This report is compatible with GitHub Automated Code Scanning (ACS), as the artifact to upload for display as a Code Scanning Alert report. | `true` |

‎action.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@ branding:
55
icon: check-circle
66
inputs:
77
image:
8-
description: 'The image to scan. This option is mutually exclusive with "path". '
8+
description: 'The image to scan. This option is mutually exclusive with "path" and "sbom". '
99
required: false
1010
path:
11-
description: 'The path to scan. This option is mutually exclusive with "image".'
11+
description: 'The path to scan. This option is mutually exclusive with "image" and "sbom".'
12+
required: false
13+
sbom:
14+
description: 'The SBOM file to scan. This option is mutually exclusive with "path" and "image".'
1215
required: false
1316
debug:
1417
description: "Set this to any value to enable verbose debug output"

‎dist/index.js‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,24 +54,45 @@ async function installGrype(version) {
5454
return `${grypePath}/${grypeBinary}`;
5555
}
5656

57+
// Determines if multiple arguments are defined
58+
function multipleDefined(...args) {
59+
let defined = false;
60+
for (const a of args) {
61+
if (defined && a) {
62+
return true;
63+
}
64+
if (a) {
65+
defined = true;
66+
}
67+
}
68+
return false;
69+
}
70+
5771
function sourceInput() {
5872
var image = core.getInput("image");
5973
var path = core.getInput("path");
74+
var sbom = core.getInput("sbom");
6075

61-
if (image && path) {
62-
throw new Error("Cannot use both 'image' and 'path' as sources");
76+
if (multipleDefined(image, path, sbom)) {
77+
throw new Error(
78+
"The following options are mutually exclusive: image, path, sbom"
79+
);
6380
}
6481

65-
if (!(image || path)) {
82+
if (!(image || path || sbom)) {
6683
throw new Error(
67-
"At least one source for scanning needs to be provided. Available options are: image, and path"
84+
"At least one source for scanning needs to be provided. Available options are: image, path and sbom"
6885
);
6986
}
7087

7188
if (image !== "") {
7289
return image;
7390
}
7491

92+
if (sbom !== "") {
93+
return "sbom:" + sbom;
94+
}
95+
7596
return "dir:" + path;
7697
}
7798

@@ -144,7 +165,7 @@ async function runScan({
144165
core.debug(`Installing grype version ${grypeVersion}`);
145166
await installGrype(grypeVersion);
146167

147-
core.debug("Image: " + source);
168+
core.debug("Source: " + source);
148169
core.debug("Debug Output: " + debug);
149170
core.debug("Fail Build: " + failBuild);
150171
core.debug("Severity Cutoff: " + severityCutoff);

‎index.js‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,24 +39,45 @@ async function installGrype(version) {
3939
return `${grypePath}/${grypeBinary}`;
4040
}
4141

42+
// Determines if multiple arguments are defined
43+
function multipleDefined(...args) {
44+
let defined = false;
45+
for (const a of args) {
46+
if (defined && a) {
47+
return true;
48+
}
49+
if (a) {
50+
defined = true;
51+
}
52+
}
53+
return false;
54+
}
55+
4256
function sourceInput() {
4357
var image = core.getInput("image");
4458
var path = core.getInput("path");
59+
var sbom = core.getInput("sbom");
4560

46-
if (image && path) {
47-
throw new Error("Cannot use both 'image' and 'path' as sources");
61+
if (multipleDefined(image, path, sbom)) {
62+
throw new Error(
63+
"The following options are mutually exclusive: image, path, sbom"
64+
);
4865
}
4966

50-
if (!(image || path)) {
67+
if (!(image || path || sbom)) {
5168
throw new Error(
52-
"At least one source for scanning needs to be provided. Available options are: image, and path"
69+
"At least one source for scanning needs to be provided. Available options are: image, path and sbom"
5370
);
5471
}
5572

5673
if (image !== "") {
5774
return image;
5875
}
5976

77+
if (sbom !== "") {
78+
return "sbom:" + sbom;
79+
}
80+
6081
return "dir:" + path;
6182
}
6283

@@ -129,7 +150,7 @@ async function runScan({
129150
core.debug(`Installing grype version ${grypeVersion}`);
130151
await installGrype(grypeVersion);
131152

132-
core.debug("Image: " + source);
153+
core.debug("Source: " + source);
133154
core.debug("Debug Output: " + debug);
134155
core.debug("Fail Build: " + failBuild);
135156
core.debug("Severity Cutoff: " + severityCutoff);

‎tests/action.test.js‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,33 @@ describe("scan-action", () => {
6060
});
6161

6262
it("errors with invalid input", () => {
63-
const outputs = runAction({
63+
let outputs = runAction({
64+
image: "some-image",
65+
path: "some-path",
66+
});
67+
expect(outputs.exitCode).toBe(1);
68+
expect(outputs.stdout).toContain(
69+
"The following options are mutually exclusive: image, path, sbom"
70+
);
71+
expect(outputs.stdout).not.toContain("grype");
72+
73+
outputs = runAction({
6474
image: "some-image",
75+
sbom: "some-path",
76+
});
77+
expect(outputs.exitCode).toBe(1);
78+
expect(outputs.stdout).toContain(
79+
"The following options are mutually exclusive: image, path, sbom"
80+
);
81+
expect(outputs.stdout).not.toContain("grype");
82+
83+
outputs = runAction({
6584
path: "some-path",
85+
sbom: "some-image",
6686
});
6787
expect(outputs.exitCode).toBe(1);
6888
expect(outputs.stdout).toContain(
69-
"Cannot use both 'image' and 'path' as sources"
89+
"The following options are mutually exclusive: image, path, sbom"
7090
);
7191
expect(outputs.stdout).not.toContain("grype");
7292
});
@@ -77,4 +97,11 @@ describe("scan-action", () => {
7797
});
7898
expect(outputs.stdout).toContain("Failed minimum severity level.");
7999
});
100+
101+
it("runs with sbom", () => {
102+
const outputs = runAction({
103+
sbom: "fixtures/test_sbom.spdx.json",
104+
});
105+
expect(outputs.stdout).toContain("Failed minimum severity level.");
106+
});
80107
});

0 commit comments

Comments
 (0)