Push results to DejaCode

.github/workflows/push-to-dejacode.yml

@@ -0,0 +1,26 @@
+on: [push]
+
+jobs:
+  scan-codebase:
+    runs-on: ubuntu-22.04
+    name: Scan codebase with ScanCode.io
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: nexB/scancode-action@push-to-dejacode
+        with:
+          pipelines: "scan_codebase"
+          output-formats: "json"
+          project-name: "packageurl-python"
+          input-urls:
+            https://github.com/package-url/packageurl-python/releases/download/v0.15.0/packageurl-python-0.15.0.tar.gz
+
+      - name: Push to DejaCode
+        shell: bash
+        run: |
+          python ${{ github.workspace }}/scripts/push_to_dejacode.py
+
+        env:
+          DEJACODE_URL: ${{ secrets.DEJACODE_URL }}
+          DEJACODE_API_KEY: ${{ secrets.DEJACODE_API_KEY }}
+          PROJECT_OUTPUT_DIRECTORY: ${{ env.PROJECT_OUTPUT_DIRECTORY }}

action.yml

@@ -114,12 +114,14 @@ runs:
         project_status=$(scanpipe status --project ${{ inputs.project-name }})
         work_directory=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+')
         echo "PROJECT_WORK_DIRECTORY=$work_directory" >> $GITHUB_ENV
+        echo "PROJECT_INPUT_DIRECTORY=$work_directory/input" >> $GITHUB_ENV
+        echo "PROJECT_OUTPUT_DIRECTORY=$work_directory/output" >> $GITHUB_ENV
 
     - name: Copy input files to project work directory
       shell: bash
       run: |
         SOURCE_PATH="${{ inputs.inputs-path }}"
-        DESTINATION_PATH="${{ env.PROJECT_WORK_DIRECTORY }}/input/"
+        DESTINATION_PATH="${{ env.PROJECT_INPUT_DIRECTORY }}"
         if [ -d "$SOURCE_PATH" ]; then
           cp -r "$SOURCE_PATH"/* "$DESTINATION_PATH"
         fi
@@ -132,15 +134,15 @@ runs:
       id: scanpipe
       shell: bash
       run: scanpipe output
-        --project ${{ inputs.project-name }} 
+        --project ${{ inputs.project-name }}
         --format ${{ inputs.output-formats }}
 
     - name: Upload outputs
       uses: actions/upload-artifact@v4
       id: artifact-upload-step
       with:
         name: ${{ inputs.outputs-archive-name }}
-        path: ${{ env.PROJECT_WORK_DIRECTORY }}/output/*
+        path: ${{ env.PROJECT_OUTPUT_DIRECTORY }}/*
 
     - name: Check compliance
       if: inputs.check-compliance == 'true'

scripts/push_to_dejacode.py

@@ -0,0 +1,82 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# http://nexb.com and https://github.com/nexB/scancode.io
+# The ScanCode.io software is licensed under the Apache License version 2.0.
+# Data generated with ScanCode.io is provided as-is without warranties.
+# ScanCode is a trademark of nexB Inc.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# Data Generated with ScanCode.io is provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+# ScanCode.io should be considered or used as legal advice. Consult an Attorney
+# for any legal advice.
+#
+# ScanCode.io is a free software code scanning tool from nexB Inc. and others.
+# Visit https://github.com/nexB/scancode.io for support and download.
+
+from pathlib import Path
+import uuid
+import requests
+import os
+
+DEJACODE_URL = os.environ["DEJACODE_URL"]
+DEJACODE_API_KEY = os.environ["DEJACODE_API_KEY"]
+
+if not (DEJACODE_URL and DEJACODE_API_KEY):
+    raise EnvironmentError("Missing required env vars.")
+
+DEJACODE_API_URL = f"{DEJACODE_URL.rstrip('/')}/api/"
+PRODUCTS_API_URL = f"{DEJACODE_API_URL}v2/products/"
+DEFAULT_TIMEOUT = 10
+
+session = requests.Session()
+if DEJACODE_API_KEY:
+    session.headers.update({"Authorization": f"Token {DEJACODE_API_KEY}"})
+
+
+def request_post(url, **kwargs):
+    """Return the response from an HTTP POST request on the provided `url` ."""
+    if "timeout" not in kwargs:
+        kwargs["timeout"] = DEFAULT_TIMEOUT
+
+    # Do not `raise_for_status` as the response may contain valuable data
+    # even on non 200 status code.
+    try:
+        response = session.post(url, **kwargs)
+        return response.json()
+    except (requests.RequestException, ValueError, TypeError) as exception:
+        print(f"[Exception] {exception}")
+
+
+def create_product(product_data):
+    response = request_post(PRODUCTS_API_URL, data=product_data)
+    return response["uuid"]
+
+
+def push_scan_to_product(files):
+    url = f"{PRODUCTS_API_URL}{product_uuid}/import_from_scan/"
+    response = request_post(url, files=files)
+    print(response)
+
+
+if __name__ == "__main__":
+    product_data = {
+        "name": "Demo Push Product",
+        "version": uuid.uuid4(),
+    }
+    product_uuid = create_product(product_data)
+
+    # Replace by args
+    PROJECT_OUTPUT_DIRECTORY = os.environ["PROJECT_OUTPUT_DIRECTORY"]
+    print(PROJECT_OUTPUT_DIRECTORY)
+    scan_location = list(Path(PROJECT_OUTPUT_DIRECTORY).glob("*.json"))[0]
+    print(scan_location)
+
+    files = {"upload_file": open(scan_location, "rb")}
+    push_scan_to_product(files)