Skip to content

feat: add BOM generation #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chris-V merged 1 commit into from
Feb 7, 2022
Merged

feat: add BOM generation #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .github/workflows/python-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,15 @@ on:
default: ""
required: false
type: string
dependency-track-project-name:
description: Project name for Dependency Track.
required: false
type: string
dependency-track-project-version:
description: Project name for Dependency Track. Typically the default branch unless multiple forks are maintained.
default: main
required: false
type: string
publish-reports:
description: Publish the generated reports to the Security Operation Center. Defaults to false.
default: false
Expand All @@ -30,6 +39,12 @@ on:
defectdojo-token:
description: DefectDojo API Token
required: false
dependency-track-url:
description: URL to the Dependency Track instance to publish the SBOM to.
required: false
dependency-track-api-key:
description: API key of the Dependency Track instance.
required: false

jobs:
secrets:
Expand Down Expand Up @@ -61,3 +76,24 @@ jobs:
language: py
report-retention-days: ${{ inputs.report-retention-days }}
working-directory: ${{ inputs.working-directory }}

sbom:
name: SBOM
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v2

- name: Setup Python
uses: equisoft-actions/setup-python@v1.0.0

- name: Generate SBOM
uses: equisoft-actions/pipenv-sbom@v1.0.0
with:
dependency-track-api-key: ${{ secrets.dependency-track-api-key }}
dependency-track-url: ${{ secrets.dependency-track-url }}
dependency-track-project-name: ${{ inputs.dependency-track-project-name }}
dependency-track-project-version: ${{ inputs.dependency-track-project-version }}
publish: ${{ inputs.publish-reports }}
report-retention-days: ${{ inputs.report-retention-days }}
working-directory: ${{ inputs.working-directory }}