diff --git a/__tests__/data/sbom.json b/__tests__/data/sbom.json new file mode 100644 index 0000000..b99e92e --- /dev/null +++ b/__tests__/data/sbom.json @@ -0,0 +1,41 @@ +{ + "spdxVersion": "SPDX-2.3", + "dataLicense": "CC0-1.0", + "SPDXID": "SPDXRef-DOCUMENT", + "name": "./", + "documentNamespace": "https://anchore.com/syft/dir/80b363b6-87f4-4162-853f-60d402537d20", + "creationInfo": { + "licenseListVersion": "3.22", + "creators": [ + "Organization: Anchore, Inc", + "Tool: syft-0.103.1" + ], + "created": "2024-01-31T18:22:50Z" + }, + "packages": [ + { + "name": "@ampproject/remapping", + "SPDXID": "SPDXRef-Package-npm--ampproject-remapping-5266573ba4f24a42", + "versionInfo": "2.2.1", + "supplier": "NOASSERTION", + "downloadLocation": "NOASSERTION", + "filesAnalyzed": false, + "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock", + "licenseConcluded": "NOASSERTION", + "licenseDeclared": "Apache-2.0", + "copyrightText": "NOASSERTION", + "externalRefs": [ + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:\\@ampproject\\/remapping:\\@ampproject\\/remapping:2.2.1:*:*:*:*:*:*:*" + }, + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:npm/%40ampproject/remapping@2.2.1" + } + ] + } + ] +} \ No newline at end of file diff --git a/action.yml b/action.yml index e967668..97491e6 100644 --- a/action.yml +++ b/action.yml @@ -55,9 +55,11 @@ runs: using: 'composite' steps: - name: Generate random SBOM output file name + if: ${{ inputs.sbom-path == '' }} run: echo "SBOM_FILENAME=${{ runner.temp }}/sbom_$(openssl rand -hex 6).json" >> $GITHUB_ENV shell: bash - name: SBOM format check + if: ${{ inputs.sbom-path == '' }} run: | if [ "${{inputs.format}}" != "spdx-json" ] && [ "${{inputs.format}}" != "cyclonedx-json" ] && [ "${{inputs.format}}" != "spdx" ] && [ "${{inputs.format}}" != "cyclonedx" ] ]; then echo "Invalid SBOM format. Supported formats are spdx-json, cyclonedx-json, spdx, cyclonedx" @@ -71,7 +73,7 @@ runs: fi shell: bash - name: Generate SBOM - if: github.event.inputs.sbom-path == '' + if: ${{ inputs.sbom-path == '' }} uses: anchore/sbom-action@v0 with: path: ${{inputs.path}}