Skip to content
This repository was archived by the owner on Mar 23, 2026. It is now read-only.

Commit 3456c16

Browse files
daisytimms2-nhsdaisytimms2-nhs
authored
Merge pull request #10 from anjalitrace2-nhs/SBOM-scan-for-non-docker-repos
Adds the option to run the SBOM action providing a path to the repo rather than a docker image. - Both inputs are optional but the job will fail if neither are provided - Updated readme with new input info - Added a job to the test workflow which checks SBOM generation works for both local & remote repos
2 parents 4f7a2cd + f2953ac commit 3456c16

File tree

3 files changed

+163
-16
lines changed

3 files changed

+163
-16
lines changed

‎.github/workflows/test-actions.yml‎

Lines changed: 119 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ jobs:
6868
6969
echo "All IaC scan assertions passed"
7070
71-
test-sbom-scan:
72-
name: Test SBOM Scan Action
71+
test-sbom-scan-docker-mode:
72+
name: Test SBOM Scan Action - Docker Image
7373
runs-on: ubuntu-latest
7474

7575
steps:
@@ -82,7 +82,6 @@ jobs:
8282
with:
8383
image-ref: 'alpine:3.18'
8484
publish-to-dependency-graph: 'false'
85-
8685
- name: Verify SBOM output with assertions
8786
run: |
8887
echo "SBOM path: ${{ steps.sbom-scan.outputs.sbom-path }}"
@@ -132,6 +131,123 @@ jobs:
132131
133132
echo "All SBOM scan assertions passed"
134133
134+
test-sbom-scan-repo-mode:
135+
name: Test SBOM Scan Action - Git Repo
136+
runs-on: ubuntu-latest
137+
steps:
138+
- name: Checkout repository
139+
uses: actions/checkout@v6
140+
- name: Test SBOM Scan with this local repo
141+
id: sbom-scan-local
142+
uses: ./sbom-scan
143+
with:
144+
repo-path: "./"
145+
publish-to-dependency-graph: "false"
146+
artifact-name: "sbom-local-repo"
147+
- name: Verify SBOM output with assertions
148+
run: |
149+
echo "SBOM path: ${{ steps.sbom-scan-local.outputs.sbom-path }}"
150+
151+
if [[ -z "${{ steps.sbom-scan-local.outputs.sbom-path }}" ]]; then
152+
echo "SBOM path output is empty"
153+
exit 1
154+
fi
155+
156+
if [[ ! -f "${{ steps.sbom-scan-local.outputs.sbom-path }}" ]]; then
157+
echo "SBOM file not found: ${{ steps.sbom-scan-local.outputs.sbom-path }}"
158+
exit 1
159+
fi
160+
161+
if [[ ! -s "${{ steps.sbom-scan-local.outputs.sbom-path }}" ]]; then
162+
echo "SBOM file is empty"
163+
exit 1
164+
fi
165+
166+
if ! jq empty "${{ steps.sbom-scan-local.outputs.sbom-path }}" 2>/dev/null; then
167+
echo "SBOM is not valid JSON"
168+
exit 1
169+
fi
170+
171+
if ! jq -e '.spdxVersion' "${{ steps.sbom-scan-local.outputs.sbom-path }}" >/dev/null; then
172+
echo "SBOM missing spdxVersion field"
173+
exit 1
174+
fi
175+
176+
if ! jq -e '.name' "${{ steps.sbom-scan-local.outputs.sbom-path }}" >/dev/null; then
177+
echo "SBOM missing name field"
178+
exit 1
179+
fi
180+
181+
if ! jq -e '.creationInfo' "${{ steps.sbom-scan-local.outputs.sbom-path }}" >/dev/null; then
182+
echo "SBOM missing creationInfo field"
183+
exit 1
184+
fi
185+
186+
if ! jq -e '.packages' "${{ steps.sbom-scan-local.outputs.sbom-path }}" >/dev/null; then
187+
echo "SBOM missing packages array"
188+
exit 1
189+
fi
190+
191+
file_size=$(wc -c < "${{ steps.sbom-scan-local.outputs.sbom-path }}")
192+
echo "SBOM file size: ${file_size} bytes"
193+
194+
echo "All SBOM scan assertions passed"
195+
- name: Test SBOM Scan with public remote repo
196+
id: sbom-scan-remote
197+
uses: ./sbom-scan
198+
with:
199+
repo-path: "https://github.com/PokeAPI/pokeapi"
200+
publish-to-dependency-graph: "false"
201+
artifact-name: "sbom-remote-repo"
202+
- name: Verify SBOM output with assertions
203+
run: |
204+
echo "SBOM path: ${{ steps.sbom-scan-remote.outputs.sbom-path }}"
205+
206+
if [[ -z "${{ steps.sbom-scan-remote.outputs.sbom-path }}" ]]; then
207+
echo "SBOM path output is empty"
208+
exit 1
209+
fi
210+
211+
if [[ ! -f "${{ steps.sbom-scan-remote.outputs.sbom-path }}" ]]; then
212+
echo "SBOM file not found: ${{ steps.sbom-scan-remote.outputs.sbom-path }}"
213+
exit 1
214+
fi
215+
216+
if [[ ! -s "${{ steps.sbom-scan-remote.outputs.sbom-path }}" ]]; then
217+
echo "SBOM file is empty"
218+
exit 1
219+
fi
220+
221+
if ! jq empty "${{ steps.sbom-scan-remote.outputs.sbom-path }}" 2>/dev/null; then
222+
echo "SBOM is not valid JSON"
223+
exit 1
224+
fi
225+
226+
if ! jq -e '.spdxVersion' "${{ steps.sbom-scan-remote.outputs.sbom-path }}" >/dev/null; then
227+
echo "SBOM missing spdxVersion field"
228+
exit 1
229+
fi
230+
231+
if ! jq -e '.name' "${{ steps.sbom-scan-remote.outputs.sbom-path }}" >/dev/null; then
232+
echo "SBOM missing name field"
233+
exit 1
234+
fi
235+
236+
if ! jq -e '.creationInfo' "${{ steps.sbom-scan-remote.outputs.sbom-path }}" >/dev/null; then
237+
echo "SBOM missing creationInfo field"
238+
exit 1
239+
fi
240+
241+
if ! jq -e '.packages' "${{ steps.sbom-scan-remote.outputs.sbom-path }}" >/dev/null; then
242+
echo "SBOM missing packages array"
243+
exit 1
244+
fi
245+
246+
file_size=$(wc -c < "${{ steps.sbom-scan-remote.outputs.sbom-path }}")
247+
echo "SBOM file size: ${file_size} bytes"
248+
249+
echo "All SBOM scan assertions passed"
250+
135251
test-multiple-scenarios:
136252
name: Test Multiple Scenarios
137253
runs-on: ubuntu-latest

‎README.md‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -69,24 +69,26 @@ Performs Software Bill of Materials (SBOM) scanning and reporting with optional
6969
- name: Generate SBOM
7070
uses: nhs-england-tools/trivy-action/sbom-scan@v1.1.0
7171
with:
72-
image-ref: 'myapp:latest'
73-
publish-to-dependency-graph: 'true'
72+
image-ref: "myapp:latest" # scan your docker image, or
73+
repo-path: "." # scan your git repo
74+
publish-to-dependency-graph: "true"
7475
github-token: ${{ secrets.GITHUB_TOKEN }}
7576
```
7677

7778
#### Inputs
7879

79-
| Input | Description | Required | Default |
80-
|-------|-------------|----------|---------|
81-
| `image-ref` | Docker image reference to scan | Yes | - |
82-
| `github-token` | GitHub token for dependency graph upload | No | - |
83-
| `publish-to-dependency-graph` | Publish SBOM to GitHub Dependency Graph | No | `false` |
84-
| `artifact-name` | Name for the uploaded SBOM artifact | No | `sbom` |
80+
| Input | Description | Required | Default |
81+
| ----------------------------- | ------------------------------------------ | ------------------------------------------ | ------- |
82+
| `image-ref` | Docker image reference to scan | Must provide either image-ref or repo-path | - |
83+
| `repo-path` | Path to git repo to scan (local or remote) | Must provide either image-ref or repo-path | - |
84+
| `github-token` | GitHub token for dependency graph upload | No | - |
85+
| `publish-to-dependency-graph` | Publish SBOM to GitHub Dependency Graph | No | `false` |
86+
| `artifact-name` | Name for the uploaded SBOM artifact | No | `sbom` |
8587

8688
#### Outputs
8789

88-
| Output | Description |
89-
|--------|-------------|
90+
| Output | Description |
91+
| ----------- | ------------------------------- |
9092
| `sbom-path` | Path to the generated SBOM file |
9193

9294
### 🔍 Image Scan

‎sbom-scan/action.yml‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,10 @@ description: Performs SBOM scanning and reporting with optional dependency graph
44
inputs:
55
image-ref:
66
description: 'Docker image reference to scan'
7-
required: true
7+
required: false
8+
repo-path:
9+
description: "Path to git repo to scan (local or remote)"
10+
required: false
811
github-token:
912
description: 'GitHub token for dependency graph upload'
1013
required: false
@@ -25,14 +28,40 @@ outputs:
2528
runs:
2629
using: "composite"
2730
steps:
28-
- name: Trivy SBOM SPDX Scan
31+
- name: Validate inputs
32+
shell: bash
33+
env:
34+
IMAGE_REF: ${{ inputs.image-ref }}
35+
REPO_PATH: ${{ inputs.repo-path }}
36+
run: |
37+
echo "IMAGE_REF:" $IMAGE_REF
38+
echo "REPO_PATH:" $REPO_PATH
39+
if [[ -z $IMAGE_REF && -z $REPO_PATH ]]; then
40+
echo "Must define one of IMAGE_REF or REPO_PATH"
41+
exit 1
42+
elif [[ -n $IMAGE_REF && -n $REPO_PATH ]]; then
43+
echo "Must define only one of IMAGE_REF or REPO_PATH, not both."
44+
exit 1
45+
fi
46+
47+
- name: Trivy SBOM SPDX Scan - Docker Image
48+
if: ${{ inputs.image-ref != '' }}
2949
uses: aquasecurity/trivy-action@0.20.0
3050
with:
3151
scan-type: image
3252
image-ref: ${{ inputs.image-ref }}
3353
format: spdx-json
3454
output: sbom.spdx.json
3555

56+
- name: Trivy SBOM SPDX Scan - Repo
57+
if: ${{ inputs.repo-path != '' }}
58+
uses: aquasecurity/trivy-action@0.20.0
59+
with:
60+
scan-type: repo
61+
scan-ref: ${{ inputs.repo-path }}
62+
format: spdx-json
63+
output: sbom.spdx.json
64+
3665
- name: Trivy SBOM Dependency Graph Upload
3766
if: ${{ inputs.publish-to-dependency-graph == 'true' && inputs.github-token != '' }}
3867
uses: aquasecurity/trivy-action@0.20.0
@@ -83,4 +112,4 @@ runs:
83112
end
84113
JQ
85114
86-
jq -r -f sbom_to_summary.jq sbom.spdx.json >> "$GITHUB_STEP_SUMMARY"
115+
jq -r -f sbom_to_summary.jq sbom.spdx.json >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)