Skip to content

Commit 9adfc09

Browse files
H-strangeoneH-strangeone
committed
whole lotta
1 parent c95555d commit 9adfc09

File tree

18 files changed

+3390
-2146
lines changed

18 files changed

+3390
-2146
lines changed

‎.github/workflows/publish-ghcr.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Publish SBOM-TM Docker Image
2+
on:
3+
push:
4+
tags:
5+
- 'v*'
6+
workflow_dispatch: {}
7+
8+
permissions:
9+
packages: write
10+
contents: read
11+
12+
jobs:
13+
build-and-push:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
19+
- name: Set up QEMU
20+
uses: docker/setup-qemu-action@v2
21+
22+
- name: Set up Docker Buildx
23+
uses: docker/setup-buildx-action@v2
24+
25+
- name: Login to GHCR
26+
uses: docker/login-action@v2
27+
with:
28+
registry: ghcr.io
29+
username: ${{ github.actor }}
30+
password: ${{ secrets.GITHUB_TOKEN }}
31+
32+
- name: Build and push image to GHCR
33+
uses: docker/build-push-action@v4
34+
with:
35+
context: .
36+
file: ./Dockerfile
37+
push: true
38+
platforms: linux/amd64,linux/arm64
39+
tags: |
40+
ghcr.io/${{ github.repository_owner }}/sbom-tm:latest
41+
ghcr.io/${{ github.repository_owner }}/sbom-tm:${{ github.ref_name }}

‎.github/workflows/release-publish-and-update-action.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Release / Publish to GHCR and Update Action
2+
on:
3+
push:
4+
tags:
5+
- 'v*'
6+
workflow_dispatch: {}
7+
8+
permissions:
9+
contents: write
10+
packages: write
11+
pull-requests: write
12+
13+
jobs:
14+
build-and-push:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v4
19+
20+
- name: Set up QEMU
21+
uses: docker/setup-qemu-action@v2
22+
23+
- name: Set up Docker Buildx
24+
uses: docker/setup-buildx-action@v3
25+
26+
- name: Log in to GHCR
27+
uses: docker/login-action@v2
28+
with:
29+
registry: ghcr.io
30+
username: ${{ github.actor }}
31+
password: ${{ secrets.GHCR_PAT }}
32+
33+
- name: Build and push image
34+
uses: docker/build-push-action@v4
35+
with:
36+
context: .
37+
file: ./Dockerfile
38+
push: true
39+
tags: |
40+
ghcr.io/${{ github.repository_owner }}/sbom-tm:${{ github.ref_name }}
41+
ghcr.io/${{ github.repository_owner }}/sbom-tm:latest
42+
43+
- name: Update `action.yml` to reference GHCR image
44+
env:
45+
GIT_AUTHOR_NAME: github-actions[bot]
46+
GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
47+
BRANCH_NAME: release/${{ github.ref_name }}
48+
IMAGE_TAG: ghcr.io/${{ github.repository_owner }}/sbom-tm:${{ github.ref_name }}
49+
PUSH_TOKEN: ${{ secrets.PERSONAL_TOKEN }}
50+
run: |
51+
git config --global user.name "$GIT_AUTHOR_NAME"
52+
git config --global user.email "$GIT_AUTHOR_EMAIL"
53+
git checkout -b "$BRANCH_NAME"
54+
if [ -f action.yml ]; then
55+
sed -E "s|image: .*|image: '$IMAGE_TAG'|" action.yml > action.yml.tmp || true
56+
mv action.yml.tmp action.yml
57+
else
58+
echo "warning: action.yml not found"
59+
fi
60+
git add action.yml || true
61+
git commit -m "chore(action): point to GHCR image $IMAGE_TAG" || true
62+
git push https://${PUSH_TOKEN}@github.com/${{ github.repository }} HEAD:$BRANCH_NAME
63+
64+
- name: Create Pull Request
65+
uses: peter-evans/create-pull-request@v5
66+
with:
67+
token: ${{ secrets.PERSONAL_TOKEN }}
68+
commit-message: "chore(action): point to GHCR image ${{ github.ref_name }}"
69+
title: "Release: point action to GHCR image ${{ github.ref_name }}"
70+
body: |
71+
This PR updates `action.yml` to use the published GHCR image for the action runtime.
72+
base: main
73+
head: release/${{ github.ref_name }}

‎.github/workflows/sbom-security.yml‎

Lines changed: 157 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -1,92 +1,157 @@
1-
name: SBOM Security Scan
2-
3-
on:
4-
pull_request:
5-
paths:
6-
- "**/*"
7-
push:
8-
branches:
9-
- main
10-
11-
jobs:
12-
sbom_scan:
13-
name: Run SBOM + Trivy + RuleEngine Scan
14-
runs-on: ubuntu-latest
15-
16-
steps:
17-
# -------------------------------
18-
# CHECKOUT SOURCE CODE
19-
# -------------------------------
20-
- name: Checkout code
21-
uses: actions/checkout@v4
22-
23-
# -------------------------------
24-
# INSTALL PYTHON
25-
# -------------------------------
26-
- name: Set up Python
27-
uses: actions/setup-python@v5
28-
with:
29-
python-version: "3.11"
30-
31-
# -------------------------------
32-
# INSTALL SBTM-TM TOOL
33-
# -------------------------------
34-
- name: Install SBOM-TM tool
35-
run: |
36-
pip install -r requirements.txt
37-
pip install .
38-
39-
# -------------------------------
40-
# INSTALL SYFT
41-
# -------------------------------
42-
- name: Install Syft
43-
uses: anchore/sbom-action/download-syft@v0.16.0
44-
45-
# -------------------------------
46-
# GENERATE SBOM
47-
# -------------------------------
48-
- name: Generate SBOM using Syft
49-
run: |
50-
syft . -o cyclonedx-json > sbom.json
51-
52-
# -------------------------------
53-
# INSTALL TRIVY
54-
# -------------------------------
55-
- name: Install Trivy
56-
uses: aquasecurity/setup-trivy@v0.4.0
57-
58-
# -------------------------------
59-
# RUN SBOM-TM SCAN (Trivy + Rules)
60-
# -------------------------------
61-
- name: Run SBOM Scan
62-
id: sbomtm
63-
run: |
64-
sbom-tm scan --sbom sbom.json --project "${{ github.event.repository.name }}" --offline
65-
continue-on-error: true
66-
67-
# -------------------------------
68-
# UPLOAD REPORTS (HTML + JSON)
69-
# -------------------------------
70-
- name: Upload security reports
71-
uses: actions/upload-artifact@v4
72-
with:
73-
name: sbom-security-reports
74-
path: |
75-
~/.cache/sbom-tm/reports/*.html
76-
~/.cache/sbom-tm/reports/*.json
77-
if-no-files-found: warn
78-
79-
# -------------------------------
80-
# FAIL PR IF THREATS FOUND
81-
# Your tool prints:
82-
# "threats=<count>"
83-
# -------------------------------
84-
- name: Block PR if threats > 0
85-
if: steps.sbomtm.outcome == 'failure'
86-
run: |
87-
echo "❌ Threats detected! Blocking PR."
88-
exit 1
89-
90-
- name: Success message
91-
if: steps.sbomtm.outcome == 'success'
92-
run: echo "✔ No threats found. Safe to merge!"
1+
name: SBOM-TM Security Scan
2+
on:
3+
push:
4+
branches: [ main, master ]
5+
pull_request:
6+
types: [opened, synchronize, reopened]
7+
8+
permissions:
9+
contents: read
10+
pull-requests: write
11+
12+
jobs:
13+
scan:
14+
name: Run SBOM-TM scan/diff
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v4
19+
20+
- name: Setup Python
21+
uses: actions/setup-python@v4
22+
with:
23+
python-version: '3.11'
24+
25+
- name: Install sbom-tm
26+
run: |
27+
python -m pip install --upgrade pip
28+
pip install .
29+
30+
- name: Run SBOM diff (compare HEAD against merge-base)
31+
id: run_diff
32+
run: |
33+
set -e
34+
PROJECT="${{ github.sha }}"
35+
sbom-tm diff --git --project "${PROJECT}"
36+
37+
- name: Locate markdown diff report
38+
id: find_report
39+
run: |
40+
set -e
41+
# look for the most recent markdown diff report
42+
REPORT="$(ls ~/.cache/sbom-tm/reports/*_sbom_diff.md 2>/dev/null | head -n1 || true)"
43+
if [ -z "$REPORT" ]; then
44+
echo "No report found"
45+
echo "report_path=" >> $GITHUB_OUTPUT
46+
exit 0
47+
fi
48+
echo "Found report: $REPORT"
49+
echo "report_path=$REPORT" >> $GITHUB_OUTPUT
50+
51+
- name: Upload report artifact
52+
if: always()
53+
uses: actions/upload-artifact@v4
54+
with:
55+
name: sbom-diff-report
56+
path: ${{ steps.find_report.outputs.report_path }}
57+
if-no-files-found: warn
58+
59+
- name: Post sticky PR comment (report)
60+
if: ${{ steps.find_report.outputs.report_path != '' && github.event_name == 'pull_request' }}
61+
uses: marocchino/sticky-pull-request-comment@v2
62+
with:
63+
path: ${{ steps.find_report.outputs.report_path }}
64+
env:
65+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
66+
name: SBOM Security Scan
67+
68+
on:
69+
pull_request:
70+
paths:
71+
- "**/*"
72+
push:
73+
branches:
74+
- main
75+
76+
jobs:
77+
sbom_scan:
78+
name: Run SBOM + Trivy + RuleEngine Scan
79+
runs-on: ubuntu-latest
80+
81+
steps:
82+
# -------------------------------
83+
# CHECKOUT SOURCE CODE
84+
# -------------------------------
85+
- name: Checkout code
86+
uses: actions/checkout@v4
87+
88+
# -------------------------------
89+
# INSTALL PYTHON
90+
# -------------------------------
91+
- name: Set up Python
92+
uses: actions/setup-python@v5
93+
with:
94+
python-version: "3.11"
95+
96+
# -------------------------------
97+
# INSTALL SBTM-TM TOOL
98+
# -------------------------------
99+
- name: Install SBOM-TM tool
100+
run: |
101+
pip install -r requirements.txt
102+
pip install .
103+
104+
# -------------------------------
105+
# INSTALL SYFT
106+
# -------------------------------
107+
- name: Install Syft
108+
uses: anchore/sbom-action/download-syft@v0.16.0
109+
110+
# -------------------------------
111+
# GENERATE SBOM
112+
# -------------------------------
113+
- name: Generate SBOM using Syft
114+
run: |
115+
syft . -o cyclonedx-json > sbom.json
116+
117+
# -------------------------------
118+
# INSTALL TRIVY
119+
# -------------------------------
120+
- name: Install Trivy
121+
uses: aquasecurity/setup-trivy@v0.4.0
122+
123+
# -------------------------------
124+
# RUN SBOM-TM SCAN (Trivy + Rules)
125+
# -------------------------------
126+
- name: Run SBOM Scan
127+
id: sbomtm
128+
run: |
129+
sbom-tm scan --sbom sbom.json --project "${{ github.event.repository.name }}" --offline
130+
continue-on-error: true
131+
132+
# -------------------------------
133+
# UPLOAD REPORTS (HTML + JSON)
134+
# -------------------------------
135+
- name: Upload security reports
136+
uses: actions/upload-artifact@v4
137+
with:
138+
name: sbom-security-reports
139+
path: |
140+
~/.cache/sbom-tm/reports/*.html
141+
~/.cache/sbom-tm/reports/*.json
142+
if-no-files-found: warn
143+
144+
# -------------------------------
145+
# FAIL PR IF THREATS FOUND
146+
# Your tool prints:
147+
# "threats=<count>"
148+
# -------------------------------
149+
- name: Block PR if threats > 0
150+
if: steps.sbomtm.outcome == 'failure'
151+
run: |
152+
echo "❌ Threats detected! Blocking PR."
153+
exit 1
154+
155+
- name: Success message
156+
if: steps.sbomtm.outcome == 'success'
157+
run: echo "✔ No threats found. Safe to merge!"

0 commit comments

Comments
 (0)