Skip to content

Commit fa5eb25

Browse files
VarshaUNVarshaUN
committed
Merge branch 'main' into JSON-local-storage
2 parents 0bc58cf + 8a4708d commit fa5eb25

File tree

198 files changed

+49941
-24947
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

198 files changed

+49941
-24947
lines changed

‎.github/workflows/generate-sboms.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
find scancodeio/ -type f -name "*.ABOUT" -exec cp {} "${{ env.INPUTS_PATH }}/about-files/" \;
3333
3434
- name: Resolve the dependencies using ScanCode-action
35-
uses: nexB/scancode-action@main
35+
uses: aboutcode-org/scancode-action@main
3636
with:
3737
pipelines: "resolve_dependencies:DynamicResolver"
3838
inputs-path: ${{ env.INPUTS_PATH }}

‎.github/workflows/publish-docker.yml‎ renamed to ‎.github/workflows/publish-docker-image.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Publish Docker image on GHCR
1+
name: Publish Docker image on GitHub Container Registry
22
# https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions
33

44
on:
@@ -15,8 +15,8 @@ env:
1515
IMAGE_NAME: ${{ github.repository }}
1616

1717
jobs:
18-
build-and-push-image:
19-
runs-on: ubuntu-22.04
18+
build-and-publish-image:
19+
runs-on: ubuntu-24.04
2020

2121
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
2222
permissions:

‎.github/workflows/pypi-release-aboutcode-pipeline.yml‎ renamed to ‎.github/workflows/publish-pypi-release-aboutcode-pipeline.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,21 @@ name: Build aboutcode.pipeline Python distributions and publish on PyPI
33
on:
44
workflow_dispatch:
55
push:
6-
tags:
7-
- "aboutcode.pipeline/*"
6+
tags:
7+
- "aboutcode.pipeline/*"
88

99
jobs:
1010
build-and-publish:
1111
name: Build and publish library to PyPI
12-
runs-on: ubuntu-22.04
12+
runs-on: ubuntu-24.04
1313

1414
steps:
1515
- uses: actions/checkout@v4
1616

1717
- name: Set up Python
1818
uses: actions/setup-python@v5
1919
with:
20-
python-version: 3.12
20+
python-version: 3.13
2121

2222
- name: Install flot
2323
run: python -m pip install flot --user

‎.github/workflows/pypi-release.yml‎ renamed to ‎.github/workflows/publish-pypi-release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,15 @@ on:
99
jobs:
1010
build-and-publish:
1111
name: Build and publish library to PyPI
12-
runs-on: ubuntu-22.04
12+
runs-on: ubuntu-24.04
1313

1414
steps:
1515
- uses: actions/checkout@v4
1616

1717
- name: Set up Python
1818
uses: actions/setup-python@v5
1919
with:
20-
python-version: 3.12
20+
python-version: 3.13
2121

2222
- name: Install pypa/build
2323
run: python -m pip install build --user

‎.github/workflows/ci-docker.yml‎ renamed to ‎.github/workflows/run-unit-tests-docker.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
1-
name: Test on Docker CI
1+
name: Run unit tests on Docker container
22

3-
on: [push, pull_request]
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
permissions:
11+
contents: read
412

513
jobs:
6-
build:
7-
runs-on: ubuntu-22.04
14+
run-unit-tests:
15+
runs-on: ubuntu-24.04
816

917
steps:
1018
- name: Checkout code

‎.github/workflows/run-unit-tests-macos.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Run unit tests on macOS
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
permissions:
11+
contents: read
12+
13+
env:
14+
POSTGRES_DB: scancodeio
15+
POSTGRES_USER: scancodeio
16+
POSTGRES_PASSWORD: scancodeio
17+
18+
jobs:
19+
run-unit-tests:
20+
runs-on: macos-13
21+
22+
strategy:
23+
matrix:
24+
python-version: ["3.10", "3.11", "3.12", "3.13"]
25+
26+
steps:
27+
- name: Checkout code
28+
uses: actions/checkout@v4
29+
30+
- name: Set up Python ${{ matrix.python-version }}
31+
uses: actions/setup-python@v5
32+
with:
33+
python-version: ${{ matrix.python-version }}
34+
35+
- name: Set up Python ${{ matrix.python-version }}
36+
uses: ikalnytskyi/action-setup-postgres@v7
37+
id: postgres
38+
with:
39+
postgres-version: "14" # 13 is not supported.
40+
database: ${{ env.POSTGRES_DB }}
41+
username: ${{ env.POSTGRES_USER }}
42+
password: ${{ env.POSTGRES_PASSWORD }}
43+
port: 5432
44+
45+
- name: Install Python dependencies
46+
run: make dev envfile
47+
48+
- name: Run Django tests
49+
run: .venv/bin/python manage.py test --verbosity=2 --noinput
50+
env:
51+
SCANCODEIO_DB_NAME: ${{ env.POSTGRES_DB }}
52+
SCANCODEIO_DB_USER: ${{ env.POSTGRES_USER }}
53+
SCANCODEIO_DB_PASSWORD: ${{ env.POSTGRES_PASSWORD }}

‎.github/workflows/ci.yml‎ renamed to ‎.github/workflows/run-unit-tests.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
1-
name: Test CI
1+
name: Run unit tests
22

3-
on: [push, pull_request]
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
permissions:
11+
contents: read
412

513
env:
614
POSTGRES_DB: scancodeio
@@ -9,8 +17,8 @@ env:
917
POSTGRES_INITDB_ARGS: --encoding=UTF-8 --lc-collate=en_US.UTF-8 --lc-ctype=en_US.UTF-8
1018

1119
jobs:
12-
build:
13-
runs-on: ubuntu-22.04
20+
run-unit-tests:
21+
runs-on: ubuntu-24.04
1422

1523
services:
1624
postgres:
@@ -31,7 +39,7 @@ jobs:
3139
strategy:
3240
max-parallel: 4
3341
matrix:
34-
python-version: ["3.10", "3.11", "3.12"]
42+
python-version: ["3.10", "3.11", "3.12", "3.13"]
3543

3644
steps:
3745
- name: Checkout code

‎.github/workflows/sca-integration-anchore.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Generate SBOM with Anchore Grype and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using Anchore Grype.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
17+
permissions:
18+
contents: read
19+
20+
env:
21+
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
23+
jobs:
24+
generate-and-load-sbom:
25+
runs-on: ubuntu-24.04
26+
steps:
27+
- name: Generate CycloneDX SBOM with Anchore Grype scanner
28+
uses: anchore/scan-action@v6
29+
with:
30+
image: ${{ env.IMAGE_REFERENCE }}
31+
output-format: cyclonedx-json
32+
output-file: "anchore-grype-sbom.cdx.json"
33+
fail-build: false
34+
35+
- name: Upload SBOM as GitHub Artifact
36+
uses: actions/upload-artifact@v4
37+
with:
38+
name: anchore-sbom-report
39+
path: "anchore-grype-sbom.cdx.json"
40+
retention-days: 20
41+
42+
- name: Import SBOM into ScanCode.io
43+
uses: aboutcode-org/scancode-action@main
44+
with:
45+
pipelines: "load_sbom"
46+
inputs-path: "anchore-grype-sbom.cdx.json"
47+
48+
- name: Verify SBOM Analysis Results in ScanCode.io
49+
shell: bash
50+
run: |
51+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 3200; assert package_manager.vulnerable().count() > 40; assert DiscoveredDependency.objects.count() > 220"

‎.github/workflows/sca-integration-cdxgen.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: Generate SBOM with CycloneDX cdxgen and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using CycloneDX cdxgen.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
17+
permissions:
18+
contents: read
19+
20+
env:
21+
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
23+
jobs:
24+
generate-and-load-sbom:
25+
runs-on: ubuntu-24.04
26+
steps:
27+
- name: Install CycloneDX cdxgen
28+
run: npm install @cyclonedx/cdxgen
29+
30+
- name: Generate SBOM with CycloneDX cdxgen
31+
run: |
32+
npx cdxgen ${{ env.IMAGE_REFERENCE }} \
33+
--type docker \
34+
--output cdxgen-sbom.cdx.json \
35+
--spec-version 1.6 \
36+
--json-pretty
37+
38+
- name: Upload SBOM as GitHub Artifact
39+
uses: actions/upload-artifact@v4
40+
with:
41+
name: cdxgen-sbom
42+
path: "cdxgen-sbom.cdx.json"
43+
retention-days: 20
44+
45+
- name: Import SBOM into ScanCode.io
46+
uses: aboutcode-org/scancode-action@main
47+
with:
48+
pipelines: "load_sbom"
49+
inputs-path: "cdxgen-sbom.cdx.json"
50+
51+
- name: Verify SBOM Analysis Results in ScanCode.io
52+
shell: bash
53+
run: |
54+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 340; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() == 0"

‎.github/workflows/sca-integration-trivy.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Generate SBOM with Trivy and load into ScanCode.io
2+
3+
# This workflow:
4+
# 1. Generates a CycloneDX SBOM for a container image using Trivy.
5+
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
6+
# 3. Loads the SBOM into ScanCode.io for further analysis.
7+
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
8+
#
9+
# It runs on demand, and once a week (scheduled).
10+
11+
on:
12+
workflow_dispatch:
13+
schedule:
14+
# Run once a week (every 7 days) at 00:00 UTC on Sunday
15+
- cron: "0 0 * * 0"
16+
17+
permissions:
18+
contents: read
19+
20+
env:
21+
IMAGE_REFERENCE: "python:3.13.0-slim"
22+
23+
jobs:
24+
generate-and-load-sbom:
25+
runs-on: ubuntu-24.04
26+
steps:
27+
- name: Generate CycloneDX SBOM with Trivy
28+
uses: aquasecurity/[email protected]
29+
with:
30+
scan-type: "image"
31+
image-ref: ${{ env.IMAGE_REFERENCE }}
32+
format: "cyclonedx"
33+
output: "trivy-report.sbom.json"
34+
scanners: "vuln,license"
35+
version: "latest"
36+
37+
- name: Upload SBOM as GitHub Artifact
38+
uses: actions/upload-artifact@v4
39+
with:
40+
name: trivy-sbom-report
41+
path: "trivy-report.sbom.json"
42+
retention-days: 20
43+
44+
- name: Import SBOM into ScanCode.io
45+
uses: aboutcode-org/scancode-action@main
46+
with:
47+
pipelines: "load_sbom"
48+
inputs-path: "trivy-report.sbom.json"
49+
50+
- name: Verify SBOM Analysis Results in ScanCode.io
51+
shell: bash
52+
run: |
53+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 90; assert package_manager.vulnerable().count() > 40; assert DiscoveredDependency.objects.count() > 190"

0 commit comments

Comments
 (0)