Skip to content

Commit 3c4bd3d

Browse files
sathiya-nhssathiya-nhs
committed
Rolling back the test SBOM changes
1 parent ae9f51d commit 3c4bd3d

File tree

2 files changed

+69
-156
lines changed

2 files changed

+69
-156
lines changed

‎.github/workflows/sbom-test.yml‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎.github/workflows/sbom.yml‎

Lines changed: 69 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -11,164 +11,100 @@ on:
1111
- yes
1212
- no
1313

14-
# env:
15-
# SYFT_VERSION: "1.27.1"
16-
# TF_VERSION: "1.12.2"
17-
18-
# jobs:
19-
# deploy:
20-
# name: Software Bill of Materials
21-
# runs-on: ubuntu-latest
22-
# permissions:
23-
# actions: read
24-
# contents: write
25-
# steps:
26-
# - name: Checkout
27-
# uses: actions/checkout@v5
28-
29-
# - name: Setup Python 3.13
30-
# uses: actions/setup-python@v5
31-
# with:
32-
# python-version: "3.13"
33-
34-
# - name: Setup Terraform
35-
# uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
36-
37-
# - uses: terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6
38-
# name: Setup TFLint
39-
40-
# - name: Set architecture variable
41-
# id: os-arch
42-
# run: |
43-
# case "${{ runner.arch }}" in
44-
# X64) ARCH="amd64" ;;
45-
# ARM64) ARCH="arm64" ;;
46-
# esac
47-
# echo "arch=${ARCH}" >> $GITHUB_OUTPUT
48-
49-
# - name: Download and setup Syft
50-
# run: |
51-
# DOWNLOAD_URL="https://github.com/anchore/syft/releases/download/v${{ env.SYFT_VERSION }}/syft_${{ env.SYFT_VERSION }}_linux_${{ steps.os-arch.outputs.arch }}.tar.gz"
52-
# echo "Downloading: ${DOWNLOAD_URL}"
53-
54-
# curl -L -o syft.tar.gz "${DOWNLOAD_URL}"
55-
# tar -xzf syft.tar.gz
56-
# chmod +x syft
57-
58-
# # Add to PATH for subsequent steps
59-
# echo "$(pwd)" >> $GITHUB_PATH
60-
61-
# - name: Create SBOM
62-
# run: bash scripts/create-sbom.sh terraform python tflint
63-
64-
# - name: Convert SBOM JSON to CSV
65-
# run: |
66-
# pip install --upgrade pip
67-
# pip install tabulate
68-
# REPO_NAME=$(basename $GITHUB_REPOSITORY)
69-
# python .github/scripts/sbom_json_to_csv.py sbom.json SBOM_${REPO_NAME}.csv
70-
71-
# - name: Upload SBOM CSV as artifact
72-
# uses: actions/upload-artifact@v4
73-
# with:
74-
# name: sbom-csv
75-
# path: SBOM_${{ github.event.repository.name }}.csv
76-
77-
# - name: Install Grype
78-
# run: |
79-
# curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
80-
81-
# - name: Scan SBOM for Vulnerabilities (JSON)
82-
# run: |
83-
# grype sbom:sbom.json -o json > grype-report.json
84-
85-
86-
87-
# - name: Convert Grype JSON to CSV
88-
# run: |
89-
# pip install --upgrade pip
90-
# REPO_NAME=$(basename $GITHUB_REPOSITORY)
91-
# python .github/scripts/grype_json_to_csv.py grype-report.json grype-report-${REPO_NAME}.csv
92-
93-
94-
# - name: Upload Vulnerability Report
95-
# uses: actions/upload-artifact@v4
96-
# with:
97-
# name: grype-report
98-
# path: grype-report-${{ github.event.repository.name }}.csv
99-
100-
# - name: Generate Package Inventory CSV
101-
# run: |
102-
# pip install --upgrade pip
103-
# REPO_NAME=$(basename $GITHUB_REPOSITORY)
104-
# python .github/scripts/sbom_packages_to_csv.py sbom.json $REPO_NAME
105-
106-
# - name: Upload Package Inventory CSV
107-
# uses: actions/upload-artifact@v4
108-
# with:
109-
# name: sbom-packages
110-
# path: sbom-packages-${{ github.event.repository.name }}.csv
14+
env:
15+
SYFT_VERSION: "1.27.1"
16+
TF_VERSION: "1.12.2"
11117

11218
jobs:
113-
sbom:
114-
runs-on: ubuntu-22.04
115-
container:
116-
image: python:3.13-slim
117-
19+
deploy:
20+
name: Software Bill of Materials
21+
runs-on: ubuntu-latest
22+
permissions:
23+
actions: read
24+
contents: write
11825
steps:
11926
- name: Checkout
120-
uses: actions/checkout@v4
27+
uses: actions/checkout@v5
12128

122-
- name: Install Poetry and Tools
123-
run: |
124-
apt-get update && apt-get install -y curl
125-
curl -sSL https://install.python-poetry.org | python3 -
126-
export PATH="$HOME/.local/bin:$PATH"
127-
pip install cyclonedx-bom tabulate
29+
- name: Setup Python 3.13
30+
uses: actions/setup-python@v5
31+
with:
32+
python-version: "3.13"
12833

129-
130-
- name: Install Grype
131-
run: |
132-
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
34+
- name: Setup Terraform
35+
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
13336

37+
- uses: terraform-linters/setup-tflint@ae78205cfffec9e8d93fd2b3115c7e9d3166d4b6
38+
name: Setup TFLint
13439

135-
- name: Install dependencies
40+
- name: Set architecture variable
41+
id: os-arch
13642
run: |
137-
export PATH="$HOME/.local/bin:$PATH"
138-
poetry install
43+
case "${{ runner.arch }}" in
44+
X64) ARCH="amd64" ;;
45+
ARM64) ARCH="arm64" ;;
46+
esac
47+
echo "arch=${ARCH}" >> $GITHUB_OUTPUT
13948
140-
# Generate SBOM in JSON
141-
- name: Generate SBOM (CycloneDX)
49+
- name: Download and setup Syft
14250
run: |
143-
cyclonedx-py poetry -o sbom.json --of json
51+
DOWNLOAD_URL="https://github.com/anchore/syft/releases/download/v${{ env.SYFT_VERSION }}/syft_${{ env.SYFT_VERSION }}_linux_${{ steps.os-arch.outputs.arch }}.tar.gz"
52+
echo "Downloading: ${DOWNLOAD_URL}"
53+
54+
curl -L -o syft.tar.gz "${DOWNLOAD_URL}"
55+
tar -xzf syft.tar.gz
56+
chmod +x syft
57+
58+
# Add to PATH for subsequent steps
59+
echo "$(pwd)" >> $GITHUB_PATH
60+
61+
- name: Create SBOM
62+
run: bash scripts/create-sbom.sh terraform python tflint
14463

145-
# Convert SBOM JSON to CSV
14664
- name: Convert SBOM JSON to CSV
14765
run: |
148-
python .github/scripts/sbom_json_to_csv.py sbom.json sbom.csv
66+
pip install --upgrade pip
67+
pip install tabulate
68+
REPO_NAME=$(basename $GITHUB_REPOSITORY)
69+
python .github/scripts/sbom_json_to_csv.py sbom.json SBOM_${REPO_NAME}.csv
14970
150-
- name: Upload SBOM artifacts
71+
- name: Upload SBOM CSV as artifact
15172
uses: actions/upload-artifact@v4
15273
with:
153-
name: sbom-files
154-
path: |
155-
sbom.json
156-
sbom.csv
74+
name: sbom-csv
75+
path: SBOM_${{ github.event.repository.name }}.csv
15776

158-
# Scan SBOM for vulnerabilities
159-
- name: Scan SBOM for Vulnerabilities
77+
- name: Install Grype
78+
run: |
79+
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
80+
81+
- name: Scan SBOM for Vulnerabilities (JSON)
16082
run: |
16183
grype sbom:sbom.json -o json > grype-report.json
84+
85+
16286

163-
# Convert Grype JSON to CSV
16487
- name: Convert Grype JSON to CSV
16588
run: |
166-
python .github/scripts/grype_json_to_csv.py grype-report.json grype-report.csv
89+
pip install --upgrade pip
90+
REPO_NAME=$(basename $GITHUB_REPOSITORY)
91+
python .github/scripts/grype_json_to_csv.py grype-report.json grype-report-${REPO_NAME}.csv
92+
16793
16894
- name: Upload Vulnerability Report
16995
uses: actions/upload-artifact@v4
17096
with:
17197
name: grype-report
172-
path: |
173-
grype-report.json
174-
grype-report.csv
98+
path: grype-report-${{ github.event.repository.name }}.csv
99+
100+
- name: Generate Package Inventory CSV
101+
run: |
102+
pip install --upgrade pip
103+
REPO_NAME=$(basename $GITHUB_REPOSITORY)
104+
python .github/scripts/sbom_packages_to_csv.py sbom.json $REPO_NAME
105+
106+
- name: Upload Package Inventory CSV
107+
uses: actions/upload-artifact@v4
108+
with:
109+
name: sbom-packages
110+
path: sbom-packages-${{ github.event.repository.name }}.csv

0 commit comments

Comments
 (0)