janhouse/sbom-tools-action
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scan: bounded tool downloads, trivy-timeout input, no-images report fix

Browse Source
This commit is contained in:
janhouse committed 2026-10-30 03:15:40 +02:00
1 parent e0b6b17a23
commit f9e42005ba
1 file changed
+13 -6
Download Patch File Download Diff File Expand all files Collapse all files
scan/action.yml
+13 -6
View File
@@ -57,6 +57,9 @@ inputs:
default: 'v0.27.2' default: 'v0.27.2'
osv-scanner-version: osv-scanner-version:
default: 'v2.7.0' default: 'v2.7.0'
trivy-timeout:
description: 'Trivy scan timeout (large images can need more than 20m)'
default: '20m'
runs: runs:
using: composite using: composite
@@ -78,9 +81,12 @@ runs:
run: | run: |
set -euo pipefail set -euo pipefail
d=~/.local/sbom-tools; mkdir -p "$d" d=~/.local/sbom-tools; mkdir -p "$d"
curl -sSfL "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" | sh -s -- -b "$d" "${TRIVY_VERSION}" # Bounded downloads: a stalled transfer hung a run for 10+ minutes.
curl -sSfL "https://github.com/CycloneDX/cyclonedx-cli/releases/download/${CDX_VERSION}/cyclonedx-linux-x64" -o "$d/cyclonedx-cli" get() { curl -sSfL --connect-timeout 20 --max-time 300 --retry 3 --retry-all-errors "$@"; }
curl -sSfL "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64" -o "$d/osv-scanner" get "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" -o "$d/trivy-install.sh"
sh "$d/trivy-install.sh" -b "$d" "${TRIVY_VERSION}"; rm -f "$d/trivy-install.sh"
get "https://github.com/CycloneDX/cyclonedx-cli/releases/download/${CDX_VERSION}/cyclonedx-linux-x64" -o "$d/cyclonedx-cli"
get "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64" -o "$d/osv-scanner"
chmod +x "$d"/* chmod +x "$d"/*
- name: Add tools to PATH - name: Add tools to PATH
@@ -93,11 +99,12 @@ runs:
SCAN_PATH: ${{ inputs.path }} SCAN_PATH: ${{ inputs.path }}
CONTAINER_IMAGE: ${{ inputs.container-image }} CONTAINER_IMAGE: ${{ inputs.container-image }}
CONTAINER_SKIP: ${{ inputs.container-skip-files }} CONTAINER_SKIP: ${{ inputs.container-skip-files }}
TRIVY_TIMEOUT: ${{ inputs.trivy-timeout }}
run: | run: |
set -euo pipefail set -euo pipefail
trivy fs "$SCAN_PATH" --quiet --timeout 20m --format cyclonedx --output source-sbom.json trivy fs "$SCAN_PATH" --quiet --timeout "$TRIVY_TIMEOUT" --format cyclonedx --output source-sbom.json
if [ -n "$CONTAINER_IMAGE" ]; then if [ -n "$CONTAINER_IMAGE" ]; then
trivy image "$CONTAINER_IMAGE" --quiet --timeout 20m --skip-files "$CONTAINER_SKIP" \ trivy image "$CONTAINER_IMAGE" --quiet --timeout "$TRIVY_TIMEOUT" --skip-files "$CONTAINER_SKIP" \
--format cyclonedx --output container-sbom.json --format cyclonedx --output container-sbom.json
cyclonedx-cli merge --input-files container-sbom.json source-sbom.json \ cyclonedx-cli merge --input-files container-sbom.json source-sbom.json \
--output-file sbom.json --output-format json --output-file sbom.json --output-format json
@@ -149,7 +156,7 @@ runs:
run: | run: |
set -euo pipefail set -euo pipefail
url=${PANEL_URL:-${DTRACK_URL%/}/panel-ci/report} url=${PANEL_URL:-${DTRACK_URL%/}/panel-ci/report}
images=$(printf '%s' "$IMAGES" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' | jq -R . | jq -s .) images=$(printf '%s' "$IMAGES" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | { grep -v '^$' || true; } | jq -R . | jq -s .) # no images is fine
tomls='[]' tomls='[]'
while IFS= read -r f; do while IFS= read -r f; do
tomls=$(jq --arg p "$f" --rawfile c "$f" '. + [{path: $p, content: $c}]' <<<"$tomls") tomls=$(jq --arg p "$f" --rawfile c "$f" '. + [{path: $p, content: $c}]' <<<"$tomls")