Skip to content

Commit fab9cbb

Browse files
committed
Add a working example for Python
Signed-off-by: Keshav Priyadarshi <[email protected]>
1 parent 30e80be commit fab9cbb

File tree

1 file changed

+54
-5
lines changed

1 file changed

+54
-5
lines changed

README.md

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ from your **GitHub Workflows**.
2525
- [Check for compliance issues](#check-for-compliance-issues)
2626
- [Define a custom project name](#define-a-custom-project-name)
2727
- [Install ScanCode.io from a repository branch](#install-scancodeio-from-a-repository-branch)
28-
- [Run source to binary mapping using GitHub action template](#run-source-to-binary-mapping-using-github-action-template)
28+
- [Run source to binary mapping](#run-source-to-binary-mapping)
2929
- [Where does the scan results go?](#where-are-the-scan-results)
3030

3131
## Usage
@@ -227,18 +227,67 @@ Activate this behavior by enabling `check-compliance` and setting
227227
scancodeio-repo-branch: "main"
228228
```
229229

230-
### Run source to binary mapping using GitHub action template
231-
1. Add job to build your binary and upload it as a GitHub actions artifact.
232-
2. Add a job to run `map-deploy-to-develop` pipeline.
230+
### Run source to binary mapping
231+
232+
Use this [workflow template](.github/workflows/map-deploy-to-develop-template.yml) for validating the integrity of open-source binary. It compares a project’s binary to its source code. Workflow will generate mapping between compiled binary and its original source code, which helps in spotting any malicious, unexpected, or otherwise undesirable code that may have made its way into the final binary.
233+
234+
#### To use follow these steps:
235+
236+
1. In your workflow add job to build binary and upload it as a GitHub actions artifact.
237+
2. Now add a second job to run source binary mapping using [template](.github/workflows/map-deploy-to-develop-template.yml).
233238
```yaml
234-
run-d2d-pipeline:
239+
map-source-binary:
235240
needs: # Job id from step 1
236241
uses: aboutcode-org/scancode-action/.github/workflows/map-deploy-to-develop-template.yml
237242
with:
238243
artifact-name: # Label of uploaded artifact from step 1
239244
steps: "python,java" # Comma separated optional steps. See https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html#map-deploy-to-develop
240245
```
241246

247+
#### An end-to-end working example for Python projects:
248+
249+
```yaml
250+
name: Run source to binary mapping on tag
251+
252+
on:
253+
workflow_dispatch:
254+
push:
255+
tags:
256+
- "v*.*.*"
257+
258+
jobs:
259+
build-python-wheel:
260+
name: Build python wheel
261+
runs-on: ubuntu-24.04
262+
263+
steps:
264+
- uses: actions/checkout@v4
265+
- name: Set up Python
266+
uses: actions/setup-python@v5
267+
with:
268+
python-version: 3.12
269+
270+
- name: Install pypa/build and twine
271+
run: python -m pip install --user --upgrade build twine packaging pip setuptools
272+
273+
- name: Build a binary wheel
274+
run: python -m build --wheel --outdir dist/
275+
276+
- name: Upload wheel
277+
uses: actions/upload-artifact@v4
278+
with:
279+
name: wheel_archives
280+
path: dist/*.whl
281+
282+
map-source-binary:
283+
name: Generate source to binary mapping
284+
needs: build-python-wheel
285+
uses: aboutcode-org/scancode-action/.github/workflows/map-deploy-to-develop-template.yml
286+
with:
287+
artifact-name: wheel_archives
288+
steps: "python"
289+
```
290+
242291
## Where are the Scan Results?
243292

244293
Upon completion of the workflow, you can **find the scan results** in the dedicated

0 commit comments

Comments
 (0)