Skip to content

Commit 97a4526

Browse files
tdrueztdruez
committed
Merge branch 'main' into django-htmx
2 parents eb1d140 + 5382bbb commit 97a4526

38 files changed

+1354
-310
lines changed

‎.github/workflows/sca-integration-anchore.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ permissions:
1919

2020
env:
2121
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
EXPECTED_PACKAGE: 3200
23+
EXPECTED_VULNERABLE_PACKAGE: 40
24+
EXPECTED_DEPENDENCY: 220
2225

2326
jobs:
2427
generate-and-load-sbom:
@@ -44,8 +47,13 @@ jobs:
4447
with:
4548
pipelines: "load_sbom"
4649
inputs-path: "anchore-grype-sbom.cdx.json"
50+
scancodeio-repo-branch: "main"
4751

4852
- name: Verify SBOM Analysis Results in ScanCode.io
4953
shell: bash
5054
run: |
51-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 3200; assert package_manager.vulnerable().count() > 40; assert DiscoveredDependency.objects.count() > 220"
55+
scanpipe verify-project \
56+
--project scancode-action \
57+
--packages ${{ env.EXPECTED_PACKAGE }} \
58+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
59+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-cdxgen.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ permissions:
1919

2020
env:
2121
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
EXPECTED_PACKAGE: 340
23+
EXPECTED_VULNERABLE_PACKAGE: 0
24+
EXPECTED_DEPENDENCY: 0
2225

2326
jobs:
2427
generate-and-load-sbom:
@@ -47,8 +50,13 @@ jobs:
4750
with:
4851
pipelines: "load_sbom"
4952
inputs-path: "cdxgen-sbom.cdx.json"
53+
scancodeio-repo-branch: "main"
5054

5155
- name: Verify SBOM Analysis Results in ScanCode.io
5256
shell: bash
5357
run: |
54-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 340; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() == 0"
58+
scanpipe verify-project \
59+
--project scancode-action \
60+
--packages ${{ env.EXPECTED_PACKAGE }} \
61+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
62+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-cyclonedx-gomod.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Generate SBOM with cyclonedx-gomod and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using cyclonedx-gomod.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
pull_request:
17+
18+
permissions:
19+
contents: read
20+
21+
env:
22+
EXPECTED_PACKAGE: 5
23+
EXPECTED_VULNERABLE_PACKAGE: 0
24+
EXPECTED_DEPENDENCY: 1
25+
26+
jobs:
27+
generate-and-load-sbom:
28+
runs-on: ubuntu-24.04
29+
steps:
30+
- name: Checkout minimal Go repo
31+
uses: actions/checkout@v4
32+
with:
33+
repository: opencontainers/runc
34+
35+
- name: Generate SBOM with cyclonedx-gomod
36+
uses: CycloneDX/gh-gomod-generate-sbom@v2
37+
with:
38+
version: v1
39+
args: mod -licenses -json -output gomod-sbom.cdx.json
40+
41+
- name: Upload SBOM as GitHub Artifact
42+
uses: actions/upload-artifact@v4
43+
with:
44+
name: sbom-report
45+
path: "gomod-sbom.cdx.json"
46+
retention-days: 20
47+
48+
- name: Import SBOM into ScanCode.io
49+
uses: aboutcode-org/scancode-action@main
50+
with:
51+
pipelines: "load_sbom"
52+
inputs-path: "gomod-sbom.cdx.json"
53+
scancodeio-repo-branch: "main"
54+
55+
- name: Verify SBOM Analysis Results in ScanCode.io
56+
shell: bash
57+
run: |
58+
scanpipe verify-project \
59+
--project scancode-action \
60+
--packages ${{ env.EXPECTED_PACKAGE }} \
61+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
62+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-depscan.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ permissions:
1919

2020
env:
2121
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
EXPECTED_PACKAGE: 220
23+
EXPECTED_VULNERABLE_PACKAGE: 10
24+
EXPECTED_DEPENDENCY: 150
2225

2326
jobs:
2427
generate-and-load-sbom:
@@ -52,8 +55,13 @@ jobs:
5255
with:
5356
pipelines: "load_sbom"
5457
inputs-path: "reports/sbom-docker.vdr.json"
58+
scancodeio-repo-branch: "main"
5559

5660
- name: Verify SBOM Analysis Results in ScanCode.io
5761
shell: bash
5862
run: |
59-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 220; assert package_manager.vulnerable().count() > 10; assert DiscoveredDependency.objects.count() > 150"
63+
scanpipe verify-project \
64+
--project scancode-action \
65+
--packages ${{ env.EXPECTED_PACKAGE }} \
66+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
67+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-ort.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,15 @@ on:
1313
schedule:
1414
# Run once a week (every 7 days) at 00:00 UTC on Sunday
1515
- cron: "0 0 * * 0"
16-
pull_request:
17-
push:
18-
branches:
19-
- main
2016

2117
permissions:
2218
contents: read
2319

20+
env:
21+
EXPECTED_PACKAGE: 5
22+
EXPECTED_VULNERABLE_PACKAGE: 1
23+
EXPECTED_DEPENDENCY: 1
24+
2425
jobs:
2526
generate-and-load-sbom:
2627
runs-on: ubuntu-24.04
@@ -47,4 +48,8 @@ jobs:
4748
- name: Verify SBOM Analysis Results in ScanCode.io
4849
shell: bash
4950
run: |
50-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 5; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 1"
51+
scanpipe verify-project \
52+
--project scancode-action \
53+
--packages ${{ env.EXPECTED_PACKAGE }} \
54+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
55+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-osv-scanner.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ permissions:
1919

2020
env:
2121
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
EXPECTED_PACKAGE: 100
23+
EXPECTED_VULNERABLE_PACKAGE: 0
24+
EXPECTED_DEPENDENCY: 90
2225

2326
jobs:
2427
generate-and-load-sbom:
@@ -56,4 +59,8 @@ jobs:
5659
- name: Verify SBOM Analysis Results in ScanCode.io
5760
shell: bash
5861
run: |
59-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 100; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() >= 100"
62+
scanpipe verify-project \
63+
--project scancode-action \
64+
--packages ${{ env.EXPECTED_PACKAGE }} \
65+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
66+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-sbom-tool.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ permissions:
1919

2020
env:
2121
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
EXPECTED_PACKAGE: 90
23+
EXPECTED_VULNERABLE_PACKAGE: 0
24+
EXPECTED_DEPENDENCY: 90
2225

2326
jobs:
2427
generate-and-load-sbom:
@@ -57,4 +60,8 @@ jobs:
5760
- name: Verify SBOM Analysis Results in ScanCode.io
5861
shell: bash
5962
run: |
60-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 90; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() > 90"
63+
scanpipe verify-project \
64+
--project scancode-action \
65+
--packages ${{ env.EXPECTED_PACKAGE }} \
66+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
67+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎.github/workflows/sca-integration-trivy.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ permissions:
1919

2020
env:
2121
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
EXPECTED_PACKAGE: 90
23+
EXPECTED_VULNERABLE_PACKAGE: 40
24+
EXPECTED_DEPENDENCY: 190
2225

2326
jobs:
2427
generate-and-load-sbom:
@@ -46,8 +49,13 @@ jobs:
4649
with:
4750
pipelines: "load_sbom"
4851
inputs-path: "trivy-report.sbom.json"
52+
scancodeio-repo-branch: "main"
4953

5054
- name: Verify SBOM Analysis Results in ScanCode.io
5155
shell: bash
5256
run: |
53-
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 90; assert package_manager.vulnerable().count() > 40; assert DiscoveredDependency.objects.count() > 190"
57+
scanpipe verify-project \
58+
--project scancode-action \
59+
--packages ${{ env.EXPECTED_PACKAGE }} \
60+
--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
61+
--dependencies ${{ env.EXPECTED_DEPENDENCY }}

‎CHANGELOG.rst‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
Changelog
22
=========
33

4-
v35.4.0 (unreleased)
4+
v35.4.1 (unreleased)
5+
--------------------
6+
7+
- Add ability to download all output results formats as a zipfile for a given project.
8+
https://github.com/aboutcode-org/scancode.io/issues/1880
9+
10+
v35.4.0 (2025-09-30)
511
--------------------
612

713
- Use deterministic UID/GID in Dockerfile.

‎Makefile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,11 @@ dev: virtualenv
5858
@echo "-> Configure and install development dependencies"
5959
@${ACTIVATE} pip install ${PIP_ARGS} --editable .[dev]
6060

61+
dev-mining: virtualenv
62+
@echo "-> Configure and install development dependencies"
63+
@$(MAKE) dev
64+
@${ACTIVATE} pip install ${PIP_ARGS} --editable .[mining]
65+
6166
envfile:
6267
@echo "-> Create the .env file and generate a secret key"
6368
@if test -f ${ENV_FILE}; then echo ".env file exists already"; exit 1; fi

0 commit comments

Comments
 (0)