Skip to content

Add a workflow for the ScanCode.io to ORT integration #1

Add a workflow for the ScanCode.io to ORT integration

Add a workflow for the ScanCode.io to ORT integration #1

name: Generate ORT package-file.yml with ScanCode.io and load into ORT
# This workflow:
# 1. Analyze a Docker image using ScanCode.io
# 1. Generates an ORT `package-file.yml` from the project results
# 2. Generates an ORT `analyzer-result.yml` using create-analyzer-result-from-package-list
# 3. Run the ORT report on `analyzer-result.yml` to generate a CycloneDX and SpdxDocument
on:
workflow_dispatch:
# schedule:
# # Run once a week (every 7 days) at 00:00 UTC on Sunday
# - cron: "0 0 * * 0"
pull_request:
push:
branches:
- main
permissions:
contents: read
env:
SCIO_IMAGE_INPUT: "docker://osadl/alpine-docker-base-image:v3.22-latest"
ORT_VERSION: "68.1.0"
jobs:
generate-and-load-sbom:
runs-on: ubuntu-24.04
steps:
- name: Analyze Docker image with ScanCode.io
uses: aboutcode-org/scancode-action@main
with:
pipelines: "analyze_docker_image"
input-urls:
"${{ env.SCIO_IMAGE_INPUT }}"
scancodeio-repo-branch: "main"
output-formats: "ort-package-list spdx cyclonedx json xlsx"
- name: DEBUG
run: |
echo ${{ env.PROJECT_WORK_DIRECTORY }}
- name: Generates an ORT analyzer-result.yml file
run: |
docker run --rm -v ${{ env.PROJECT_WORK_DIRECTORY }}/output:/data \
--entrypoint /opt/ort/bin/orth \
ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
create-analyzer-result-from-package-list \
--package-list-file /data/package-list.yml \
--ort-file /data/analyzer-result.yml
- name: Generates an ORT analyzer-result.yml file
run: |
docker run --rm -v ${{ env.PROJECT_WORK_DIRECTORY }}/output:/data \
ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
report \
--ort-file /data/analyzer-result.yml \
--output-dir /data/results/ \
--report-formats CycloneDX,SpdxDocument