Skip to content

Commit d1f65cd

Browse files
VarshaUNVarshaUN
authored
Merge branch 'main' into JSON-local-storage
2 parents 87c81bd + c69e8a0 commit d1f65cd

File tree

78 files changed

+13570
-268
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

78 files changed

+13570
-268
lines changed

‎.github/workflows/sca-integration-depscan.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Generate SBOM with OWASP dep-scan and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using OWASP dep-scan.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
17+
permissions:
18+
contents: read
19+
20+
env:
21+
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
23+
jobs:
24+
generate-and-load-sbom:
25+
runs-on: ubuntu-24.04
26+
steps:
27+
- name: Install OWASP dep-scan
28+
run: |
29+
sudo npm install -g @cyclonedx/cdxgen
30+
pip install owasp-depscan
31+
32+
- name: Generate SBOM with OWASP dep-scan
33+
run: |
34+
depscan \
35+
--src ${{ env.IMAGE_REFERENCE }} \
36+
--type docker \
37+
--reports-dir reports \
38+
--explain
39+
40+
- name: Upload SBOM as GitHub Artifact
41+
uses: actions/upload-artifact@v4
42+
with:
43+
name: depscan-sbom
44+
path: reports/
45+
retention-days: 20
46+
47+
- name: Uninstall dep-scan to avoid conflicts in the Python env
48+
run: pip uninstall --yes owasp-depscan
49+
50+
- name: Import SBOM into ScanCode.io
51+
uses: aboutcode-org/scancode-action@main
52+
with:
53+
pipelines: "load_sbom"
54+
inputs-path: "reports/sbom-docker.vdr.json"
55+
56+
- name: Verify SBOM Analysis Results in ScanCode.io
57+
shell: bash
58+
run: |
59+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 220; assert package_manager.vulnerable().count() > 10; assert DiscoveredDependency.objects.count() > 150"

‎.github/workflows/sca-integration-ort-package-file.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Generate ORT package-file.yml with ScanCode.io and load into ORT
2+
3+
# This workflow:
4+
# 1. Analyze a Docker image using ScanCode.io
5+
# 2. Generates an ORT `package-file.yml` from the SCIO project results
6+
# 3. Generates an ORT `analyzer-result.yml` using create-analyzer-result-from-package-list
7+
# 4. Run the ORT report on `analyzer-result.yml` to generate a CycloneDX and SpdxDocument
8+
9+
on:
10+
workflow_dispatch:
11+
schedule:
12+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
13+
- cron: "0 0 * * 0"
14+
15+
permissions:
16+
contents: read
17+
18+
env:
19+
SCIO_IMAGE_INPUT: "docker://osadl/alpine-docker-base-image:v3.22-latest"
20+
ORT_VERSION: "68.1.0"
21+
22+
jobs:
23+
generate-and-load-sbom:
24+
runs-on: ubuntu-24.04
25+
steps:
26+
- name: Analyze Docker image with ScanCode.io
27+
uses: aboutcode-org/scancode-action@main
28+
with:
29+
pipelines: "analyze_docker_image"
30+
input-urls:
31+
"${{ env.SCIO_IMAGE_INPUT }}"
32+
scancodeio-repo-branch: "main"
33+
output-formats: "ort-package-list spdx:2.2 cyclonedx json xlsx"
34+
35+
- name: Copy package-list.yml to workspace root
36+
run: |
37+
FILE=$(ls ${{ env.PROJECT_WORK_DIRECTORY }}/output/*.package-list.yml | head -n 1)
38+
sudo mkdir -p ${GITHUB_WORKSPACE}/ort-data/
39+
sudo cp "$FILE" "${GITHUB_WORKSPACE}/ort-data/package-list.yml"
40+
sudo chmod -R 777 ${GITHUB_WORKSPACE}/ort-data/
41+
ls -lh "${GITHUB_WORKSPACE}/ort-data/"
42+
43+
- name: Generates an ORT analyzer-result.yml file
44+
run: |
45+
docker run --rm -v ${GITHUB_WORKSPACE}/ort-data:/data \
46+
--entrypoint /opt/ort/bin/orth \
47+
ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
48+
create-analyzer-result-from-package-list \
49+
--package-list-file /data/package-list.yml \
50+
--ort-file /data/analyzer-result.yml
51+
52+
- name: Report as CycloneDX and SPDX using the analyzer-result.yml file
53+
run: |
54+
docker run --rm -v ${GITHUB_WORKSPACE}/ort-data:/data \
55+
ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
56+
report \
57+
--ort-file /data/analyzer-result.yml \
58+
--output-dir /data/results/ \
59+
--report-formats CycloneDX,SpdxDocument
60+
61+
- name: Upload SBOMs as GitHub Artifact
62+
uses: actions/upload-artifact@v4
63+
with:
64+
name: ort-report
65+
path: "${GITHUB_WORKSPACE}/ort-data/results"
66+
retention-days: 20

‎.github/workflows/sca-integration-ort.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Generate SBOM with ORT and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a requirement.txt file using ORT.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
pull_request:
17+
push:
18+
branches:
19+
- main
20+
21+
permissions:
22+
contents: read
23+
24+
jobs:
25+
generate-and-load-sbom:
26+
runs-on: ubuntu-24.04
27+
steps:
28+
- name: Create a Python requirements.txt
29+
run: |
30+
cat << 'EOF' > requirements.txt
31+
amqp==5.1.1
32+
appdirs==1.4.4
33+
asgiref==3.5.2
34+
urllib3==1.26.0
35+
EOF
36+
37+
- name: Run GitHub Action for ORT
38+
uses: oss-review-toolkit/ort-ci-github-action@v1
39+
40+
- name: Import SBOM into ScanCode.io
41+
uses: aboutcode-org/scancode-action@main
42+
with:
43+
pipelines: "load_sbom"
44+
inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
45+
scancodeio-repo-branch: "main"
46+
47+
- name: Verify SBOM Analysis Results in ScanCode.io
48+
shell: bash
49+
run: |
50+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 5; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 1"

‎.github/workflows/sca-integration-osv-scanner.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Generate SBOM with OSV-Scanner and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using OSV-Scanner.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
17+
permissions:
18+
contents: read
19+
20+
env:
21+
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
23+
jobs:
24+
generate-and-load-sbom:
25+
runs-on: ubuntu-24.04
26+
steps:
27+
- name: Install OSV-Scanner
28+
run: |
29+
curl -sLO https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64
30+
chmod +x osv-scanner_linux_amd64
31+
sudo mv osv-scanner_linux_amd64 /usr/local/bin/osv-scanner
32+
33+
- name: Run OSV Scanner
34+
# Using `|| true` as OSV-Scanner exits with code 1 when vulnerabilities are found.
35+
run: |
36+
osv-scanner scan image ${{ env.IMAGE_REFERENCE }} \
37+
--all-packages \
38+
--format spdx-2-3 \
39+
--output osv-sbom.spdx.json \
40+
|| true
41+
42+
- name: Upload SBOM as GitHub Artifact
43+
uses: actions/upload-artifact@v4
44+
with:
45+
name: osv-scanner-sbom-report
46+
path: osv-sbom.spdx.json
47+
retention-days: 20
48+
49+
- name: Import SBOM into ScanCode.io
50+
uses: aboutcode-org/scancode-action@main
51+
with:
52+
pipelines: "load_sbom"
53+
inputs-path: "osv-sbom.spdx.json"
54+
scancodeio-repo-branch: "main"
55+
56+
- name: Verify SBOM Analysis Results in ScanCode.io
57+
shell: bash
58+
run: |
59+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 100; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() >= 100"

‎.github/workflows/sca-integration-sbom-tool.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Generate SBOM with SBOM tool and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using SBOM tool.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
17+
permissions:
18+
contents: read
19+
20+
env:
21+
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
23+
jobs:
24+
generate-and-load-sbom:
25+
runs-on: ubuntu-24.04
26+
steps:
27+
- name: Download SBOM tool
28+
run: |
29+
curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
30+
chmod +x $RUNNER_TEMP/sbom-tool
31+
32+
- name: Generate SBOM with SBOM tool
33+
run: |
34+
mkdir -p sbom-output
35+
$RUNNER_TEMP/sbom-tool generate \
36+
-di ${{ env.IMAGE_REFERENCE }} \
37+
-pn DockerImage \
38+
-pv 1.0.0 \
39+
-ps Company \
40+
-nsb https://sbom.company.com \
41+
-m sbom-output \
42+
-V Verbose
43+
44+
- name: Upload SBOM artifact
45+
uses: actions/upload-artifact@v4
46+
with:
47+
name: sbom-output
48+
path: sbom-output
49+
50+
- name: Import SBOM into ScanCode.io
51+
uses: aboutcode-org/scancode-action@main
52+
with:
53+
pipelines: "load_sbom"
54+
inputs-path: "sbom-output/_manifest/spdx_2.2/manifest.spdx.json"
55+
scancodeio-repo-branch: "main"
56+
57+
- name: Verify SBOM Analysis Results in ScanCode.io
58+
shell: bash
59+
run: |
60+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 90; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() > 90"

‎CHANGELOG.rst‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,45 @@
11
Changelog
22
=========
33

4+
v35.4.0 (unreleased)
5+
--------------------
6+
7+
- Use deterministic UID/GID in Dockerfile.
8+
A temporary ``chown`` service is now started in the ``docker-compose`` stack
9+
to fix the permissions. This process is only fully run once.
10+
You may manually run this process using the following:
11+
``$ chown -R 1000:1000 /var/scancodeio/``
12+
https://github.com/aboutcode-org/scancode.io/issues/1555
13+
14+
- Resolve and load dependencies from SPDX SBOMs.
15+
https://github.com/aboutcode-org/scancode.io/issues/1145
16+
17+
- Display the optional steps in the Pipelines autodoc.
18+
https://github.com/aboutcode-org/scancode.io/issues/1822
19+
20+
- Add new ``benchmark_purls`` pipeline.
21+
https://github.com/aboutcode-org/scancode.io/issues/1804
22+
23+
- Add a Resources tree view.
24+
https://github.com/aboutcode-org/scancode.io/issues/1682
25+
26+
- Improve CycloneDX SBOM support.
27+
* Upgrade the cyclonedx-python-lib to 11.0.0
28+
* Fix the validate_document following library upgrade.
29+
* Add support when the "components" entry is missing.
30+
https://github.com/aboutcode-org/scancode.io/issues/1727
31+
32+
- Split the functionality of
33+
``scanpipe.pipes.federatedcode.commit_and_push_changes`` into
34+
``scanpipe.pipes.federatedcode.commit_changes`` and
35+
``scanpipe.pipes.federatedcode.push_changes``. Add
36+
``scanpipe.pipes.federatedcode.write_data_as_yaml``.
37+
38+
- Add ORT ``package-list.yml`` as new downloadable output format.
39+
https://github.com/aboutcode-org/scancode.io/pull/1852
40+
41+
- Add support for SPDX as YAML in ``load_sbom`` pipeline.
42+
443
v35.3.0 (2025-08-20)
544
--------------------
645

0 commit comments

Comments
 (0)