Skip to content

Commit 072dde0

Browse files
tsteenbetsteenbe
committed
Add workflows to test the ORT to ScanCode.io integration
Resolves #1727 #1884. Signed-off-by: Thomas Steenbergen <[email protected]>
1 parent 4e3b912 commit 072dde0

File tree

1 file changed

+351
-6
lines changed

1 file changed

+351
-6
lines changed

‎.github/workflows/sca-integration-ort.yml‎

Lines changed: 351 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
name: Generate SBOM with ORT and load into ScanCode.io
1+
name: Generate or load SBOMs from ORT into ScanCode.io
22

33
# This workflow:
4-
# 1. Generates a CycloneDX SBOM for a requirement.txt file using ORT.
5-
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
4+
# 1. Generates CycloneDX and SPDX SBOM with ORT, or
5+
# 2. Loads ORT SBOM test assests
66
# 3. Loads the SBOM into ScanCode.io for further analysis.
77
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
88
#
@@ -23,7 +23,95 @@ env:
2323
EXPECTED_DEPENDENCY: 1
2424

2525
jobs:
26-
generate-and-load-sbom:
26+
checkout-ort-test-assests-from-scancode-io-repo:
27+
runs-on: ubuntu-24.04
28+
steps:
29+
- name: Checkout ScanCode.io repository
30+
uses: actions/checkout@v5
31+
32+
- name: Upload orthw mime types example
33+
uses: actions/upload-artifact@v4
34+
with:
35+
name: npm-mime-types-2.1.26-scan-result.json
36+
path: scanpipe/tests/data/integrations-ort/orthw-example-scan-result/npm-mime-types-2.1.26-scan-result.json
37+
overwrite: true
38+
retention-days: 1
39+
40+
- name: Upload CycloneDX v1.6 ORT test result
41+
uses: actions/upload-artifact@v4
42+
with:
43+
name: ort-cyclonedx-1.6-result.cyclonedx.json
44+
path: scanpipe/tests/data/integrations-ort/ort-reporter-cyclonedx-1.6-funtest-resources/cyclonedx-reporter-expected-result.json
45+
overwrite: true
46+
retention-days: 1
47+
48+
- name: Upload CycloneDX v1.6 ORT test result with findings
49+
uses: actions/upload-artifact@v4
50+
with:
51+
name: ort-cyclonedx-1.6-result-with-findings.cyclonedx.json
52+
path: scanpipe/tests/data/integrations-ort/ort-reporter-cyclonedx-1.6-funtest-resources/cyclonedx-reporter-expected-result-with-findings.json
53+
overwrite: true
54+
retention-days: 1
55+
56+
- name: Upload CycloneDX v1.6 ORT test result without findings
57+
uses: actions/upload-artifact@v4
58+
with:
59+
name: ort-cyclonedx-1.6-result-without-findings.cyclonedx.json
60+
path: scanpipe/tests/data/integrations-ort/ort-reporter-cyclonedx-1.6-funtest-resources/cyclonedx-reporter-expected-result-without-findings.json
61+
overwrite: true
62+
retention-days: 1
63+
64+
- name: Upload SPDX v2.2 ORT test result
65+
uses: actions/upload-artifact@v4
66+
with:
67+
name: ort-spdx-2.2-result.spdx.json
68+
path: scanpipe/tests/data/integrations-ort/ort-reporter-spdx-2.2-funtest-resources/synthetic-scan-result-expected-output.spdx.json
69+
overwrite: true
70+
retention-days: 1
71+
72+
- name: Upload SPDX v2.3 ORT test result
73+
uses: actions/upload-artifact@v4
74+
with:
75+
name: ort-spdx-2.3-result.spdx.json
76+
path: scanpipe/tests/data/integrations-ort/ort-reporter-spdx-2.3-funtest-resources/synthetic-scan-result-expected-output.spdx.json
77+
overwrite: true
78+
retention-days: 1
79+
80+
generate-python-cyclonedx-1-5-sbom-with-ort-load-into-scancode-io:
81+
runs-on: ubuntu-24.04
82+
steps:
83+
- name: Create a Python requirements.txt
84+
run: |
85+
cat << 'EOF' > requirements.txt
86+
click==6.7
87+
Flask==1.0
88+
itsdangerous==0.24
89+
EOF
90+
91+
- name: Run GitHub Action for ORT
92+
uses: oss-review-toolkit/ort-ci-github-action@main
93+
with:
94+
ort-cli-report-args: "-O CycloneDX=output.file.formats=json -O CycloneDX=schema.version=1.5"
95+
report-formats: "CycloneDx"
96+
run: >
97+
analyzer,
98+
evaluator,
99+
advisor,
100+
reporter
101+
102+
- name: Import SBOM into ScanCode.io
103+
uses: aboutcode-org/scancode-action@main
104+
with:
105+
pipelines: "load_sbom"
106+
inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
107+
scancodeio-repo-branch: "main"
108+
109+
- name: Verify SBOM analysis results in ScanCode.io
110+
shell: bash
111+
run: |
112+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 6; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 5"
113+
114+
generate-python-cyclonedx-1-6-sbom-with-ort-load-into-scancode-io:
27115
runs-on: ubuntu-24.04
28116
steps:
29117
- name: Create a Python requirements.txt
@@ -36,7 +124,15 @@ jobs:
36124
EOF
37125
38126
- name: Run GitHub Action for ORT
39-
uses: oss-review-toolkit/ort-ci-github-action@v1
127+
uses: oss-review-toolkit/ort-ci-github-action@main
128+
with:
129+
ort-cli-report-args: "-O CycloneDX=output.file.formats=json -O CycloneDX=schema.version=1.6"
130+
report-formats: "CycloneDx"
131+
run: >
132+
analyzer,
133+
evaluator,
134+
advisor,
135+
reporter
40136
41137
- name: Import SBOM into ScanCode.io
42138
uses: aboutcode-org/scancode-action@main
@@ -45,11 +141,260 @@ jobs:
45141
inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
46142
scancodeio-repo-branch: "main"
47143

48-
- name: Verify SBOM Analysis Results in ScanCode.io
144+
- name: Verify SBOM analysis results in ScanCode.io
49145
shell: bash
50146
run: |
51147
scanpipe verify-project \
52148
--project scancode-action \
53149
--packages ${{ env.EXPECTED_PACKAGE }} \
54150
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
55151
--dependencies ${{ env.EXPECTED_DEPENDENCY }}
152+
153+
generate-mime-types-sboms-from-ort-from-scan-result:
154+
needs: checkout-ort-test-assests-from-scancode-io-repo
155+
runs-on: ubuntu-24.04
156+
steps:
157+
- name: Download mime-type-2.1.26-scan-result file
158+
uses: actions/download-artifact@v5
159+
with:
160+
name: npm-mime-types-2.1.26-scan-result.json
161+
162+
- name: Move mime-types scan result expected location by GitHub Action for ORT
163+
run: |
164+
mkdir -p $HOME/.ort/ort-results/
165+
mv npm-mime-types-2.1.26-scan-result.json \
166+
$HOME/.ort/ort-results/current-result.json
167+
cat $HOME/.ort/ort-results/current-result.json
168+
169+
- name: Run GitHub Action for ORT
170+
uses: oss-review-toolkit/ort-ci-github-action@main
171+
with:
172+
report-formats: "CycloneDx,SpdxDocument"
173+
run: >
174+
evaluator,
175+
advisor,
176+
reporter
177+
- name: Upload orthw mime type example
178+
179+
- uses: actions/upload-artifact@v4
180+
with:
181+
name: npm-mime-types-2.1.26-ort-sboms
182+
path: |
183+
${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json
184+
${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.xml
185+
${{ env.ORT_RESULTS_PATH }}/bom.spdx.json
186+
${{ env.ORT_RESULTS_PATH }}/bom.spdx.yml
187+
overwrite: true
188+
retention-days: 1
189+
190+
load-ort-cyclonedx-1-6-json-into-scancode-io:
191+
needs: checkout-ort-test-assests-from-scancode-io-repo
192+
runs-on: ubuntu-24.04
193+
steps:
194+
- name: Download ORT CycloneDX JSON SBOM
195+
uses: actions/download-artifact@v5
196+
with:
197+
name: ort-cyclonedx-1.6-result.cyclonedx.json
198+
199+
- name: Import SBOM into ScanCode.io
200+
uses: aboutcode-org/scancode-action@main
201+
with:
202+
pipelines: "load_sbom"
203+
inputs-path: "cyclonedx-reporter-expected-result.json"
204+
output-formats: "cyclonedx"
205+
scancodeio-repo-branch: "main"
206+
207+
- name: Verify SBOM analysis results in ScanCode.io
208+
shell: bash
209+
run: |
210+
# FIXME ScanCode.io incorrectly flag CVE-2021-1234 as applicable to this scan.
211+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 5; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 0"
212+
213+
load-ort-cyclonedx-1-6-json-sbom-with-findings-into-scancode-io:
214+
needs: checkout-ort-test-assests-from-scancode-io-repo
215+
runs-on: ubuntu-24.04
216+
steps:
217+
- name: Download ORT CycloneDX v1.6 JSON SBOM
218+
uses: actions/download-artifact@v5
219+
with:
220+
name: ort-cyclonedx-1.6-result-with-findings.cyclonedx.json
221+
222+
- name: Import SBOM into ScanCode.io
223+
uses: aboutcode-org/scancode-action@main
224+
with:
225+
pipelines: "load_sbom"
226+
inputs-path: "cyclonedx-reporter-expected-result-with-findings.json"
227+
output-formats: "cyclonedx"
228+
scancodeio-repo-branch: "main"
229+
230+
- name: Verify SBOM analysis results in ScanCode.io
231+
shell: bash
232+
run: |
233+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >=5; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 0"
234+
235+
load-ort-cyclonedx-1-6-json-sbom-without-findings-into-scancode-io:
236+
needs: checkout-ort-test-assests-from-scancode-io-repo
237+
runs-on: ubuntu-24.04
238+
steps:
239+
- name: Download ORT CycloneDX v1.6 JSON SBOM
240+
uses: actions/download-artifact@v5
241+
with:
242+
name: ort-cyclonedx-1.6-result-without-findings.cyclonedx.json
243+
244+
- name: Import SBOM into ScanCode.io
245+
uses: aboutcode-org/scancode-action@main
246+
with:
247+
pipelines: "load_sbom"
248+
inputs-path: "cyclonedx-reporter-expected-result-without-findings.json"
249+
output-formats: "cyclonedx"
250+
scancodeio-repo-branch: "main"
251+
252+
- name: Verify SBOM analysis results in ScanCode.io
253+
shell: bash
254+
run: |
255+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() == 0; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() == 0"
256+
257+
load-ort-spdx-2-2-json-sbom-into-scancode-io:
258+
needs: checkout-ort-test-assests-from-scancode-io-repo
259+
runs-on: ubuntu-24.04
260+
steps:
261+
- name: Download ORT SPDX v2.2 JSON SBOM
262+
uses: actions/download-artifact@v5
263+
with:
264+
name: ort-spdx-2.2-result.spdx.json
265+
266+
- name: Import SBOM into ScanCode.io
267+
uses: aboutcode-org/scancode-action@main
268+
with:
269+
pipelines: "load_sbom"
270+
inputs-path: "synthetic-scan-result-expected-output.spdx.json"
271+
output-formats: "spdx"
272+
scancodeio-repo-branch: "main"
273+
274+
- name: Verify SBOM analysis results in ScanCode.io
275+
shell: bash
276+
run: |
277+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 12; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 11"
278+
279+
load-ort-spdx-2-3-json-sbom-into-scancode-io:
280+
needs: checkout-ort-test-assests-from-scancode-io-repo
281+
runs-on: ubuntu-24.04
282+
steps:
283+
- name: Download ORT SPDX v2.3 JSON SBOM
284+
uses: actions/download-artifact@v5
285+
with:
286+
name: ort-spdx-2.3-result.spdx.json
287+
288+
- name: Import SBOM into ScanCode.io
289+
uses: aboutcode-org/scancode-action@main
290+
with:
291+
pipelines: "load_sbom"
292+
inputs-path: "synthetic-scan-result-expected-output.spdx.json"
293+
output-formats: "spdx"
294+
scancodeio-repo-branch: "main"
295+
296+
- name: Verify SBOM analysis results in ScanCode.io
297+
shell: bash
298+
run: |
299+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 12; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 11"
300+
301+
load-ort-mime-types-cyclonedx-json-sbom-into-scancode-io:
302+
needs: generate-mime-types-sboms-from-ort-from-scan-result
303+
runs-on: ubuntu-24.04
304+
steps:
305+
- name: Download ORT CycloneDX JSON SBOM for mime-types 2.1.26
306+
uses: actions/download-artifact@v5
307+
with:
308+
name: npm-mime-types-2.1.26-ort-sboms
309+
310+
- name: Import SBOM into ScanCode.io
311+
uses: aboutcode-org/scancode-action@main
312+
with:
313+
pipelines: "load_sbom"
314+
inputs-path: "bom.cyclonedx.json"
315+
output-formats: "cyclonedx"
316+
scancodeio-repo-branch: "main"
317+
318+
- name: Verify SBOM analysis results in ScanCode.io
319+
shell: bash
320+
run: |
321+
# FIXME Number of packages and dependencies detected is wrong
322+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 380; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 628"
323+
324+
# FIXME: Loading CycloneDX SBOM in YAML format fails for unclear reasons.
325+
#
326+
# load-ort-mime-types-cyclonedx-xml-sbom-into-scancode-io:
327+
# needs: generate-mime-types-sboms-from-ort-from-scan-result
328+
# runs-on: ubuntu-24.04
329+
# steps:
330+
# - name: Download ORT CycloneDX JSON SBOM for mime-types 2.1.26
331+
# uses: actions/download-artifact@v5
332+
# with:
333+
# name: npm-mime-types-2.1.26-ort-sboms
334+
335+
# - name: Import SBOM into ScanCode.io
336+
# uses: aboutcode-org/scancode-action@main
337+
# with:
338+
# pipelines: "load_sbom"
339+
# inputs-path: "bom.cyclonedx.xml"
340+
# output-formats: "cyclonedx"
341+
# scancodeio-repo-branch: "main"
342+
343+
# - name: Verify SBOM analysis results in ScanCode.io
344+
# shell: bash
345+
# run: |
346+
# # FIXME Number of packages and dependencies detected is wrong
347+
# scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 405; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 0"
348+
349+
load-mime-types-spdx-json-sbom-into-scancode-io:
350+
needs: generate-mime-types-sboms-from-ort-from-scan-result
351+
runs-on: ubuntu-24.04
352+
steps:
353+
- name: Download ORT SPDX JSON SBOM for mime-types 2.1.26
354+
uses: actions/download-artifact@v5
355+
with:
356+
name: npm-mime-types-2.1.26-ort-sboms
357+
358+
- name: Cat SPDX JSON - for debugging purposes only, remove ASAP
359+
run: |
360+
cat bom.spdx.json
361+
362+
- name: Import SBOM into ScanCode.io
363+
uses: aboutcode-org/scancode-action@main
364+
with:
365+
pipelines: "load_sbom"
366+
inputs-path: "bom.spdx.json"
367+
output-formats: "spdx"
368+
scancodeio-repo-branch: "main"
369+
370+
- name: Verify SBOM analysis results in ScanCode.io
371+
shell: bash
372+
run: |
373+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 1141; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 1,397"
374+
375+
load-mime-types-spdx-yml-sbom-into-scancode-io:
376+
needs: generate-mime-types-sboms-from-ort-from-scan-result
377+
runs-on: ubuntu-24.04
378+
steps:
379+
- name: Download ORT SPDX YAML SBOM for mime-types 2.1.26
380+
uses: actions/download-artifact@v5
381+
with:
382+
name: npm-mime-types-2.1.26-ort-sboms
383+
384+
- name: Cat SPDX YAML - for debugging purposes only, remove ASAP
385+
run: |
386+
cat bom.spdx.yml
387+
388+
- name: Import SBOM into ScanCode.io
389+
uses: aboutcode-org/scancode-action@main
390+
with:
391+
pipelines: "load_sbom"
392+
inputs-path: "bom.spdx.yml"
393+
output-formats: "spdx"
394+
scancodeio-repo-branch: "main"
395+
396+
- name: Verify SBOM analysis results in ScanCode.io
397+
shell: bash
398+
run: |
399+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 1141; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 1,397"
400+
>>>>>>> 218fc4f2 (Add workflows to test the ORT to ScanCode.io integration)

0 commit comments

Comments
 (0)