-
Notifications
You must be signed in to change notification settings - Fork 7
116 lines (113 loc) · 6.52 KB
/
generate_sboms.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: Generate SBOMs for a release
on:
workflow_dispatch:
inputs:
#checkov:skip=CKV_GHA_7:This is a false positive
release:
description: 'SecObserve release (without the v)'
required: true
permissions: read-all
jobs:
generate_sboms:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
-
name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: 'v${{ github.event.inputs.release }}'
-
name: Install programs
env:
CYCLONE_DX_BOM_VERSION: 4.1.2
CYCLONE_DX_NPM_VERSION: 1.16.1
SBOM_UTILITY_VERSION: 0.15.0
PARLAY_VERSION: 0.3.0
TRIVY_VERSION: 0.49.1
CYCLONE_DX_CLI_VERSION: 0.25.0
run: |
sudo apt-get update
sudo apt-get install -y python3-pip npm
python -m pip install --upgrade cyclonedx-bom=="$CYCLONE_DX_BOM_VERSION"
npm install -g @cyclonedx/cyclonedx-npm@"$CYCLONE_DX_NPM_VERSION"
cd /usr/local/bin
wget --no-verbose https://github.com/CycloneDX/sbom-utility/releases/download/v"$SBOM_UTILITY_VERSION"/sbom-utility-v"$SBOM_UTILITY_VERSION"-linux-amd64.tar.gz -O - | tar -zxf -
wget --no-verbose https://github.com/snyk/parlay/releases/download/v"$PARLAY_VERSION"/parlay_Linux_x86_64.tar.gz -O - | tar -zxf -
wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v"$TRIVY_VERSION"/trivy_"$TRIVY_VERSION"_Linux-64bit.tar.gz -O - | tar -zxf -
wget --no-verbose https://github.com/CycloneDX/cyclonedx-cli/releases/download/v"$CYCLONE_DX_CLI_VERSION"/cyclonedx-linux-x64
cp cyclonedx-linux-x64 /usr/local/bin/cyclonedx
chmod +x /usr/local/bin/cyclonedx
-
name: Generate SBOM for backend application
env:
VERSION: ${{ github.event.inputs.release }}
working-directory: ./sbom
run: |
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_backend_application.json
cyclonedx-py poetry --only main,prod --output-format json ../backend \
| parlay ecosystems enrich - \
| sbom-utility trim --keys=externalReferences,properties,vulnerabilities --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_backend_application.json --quiet --input-file - --output-file sbom_backend_application_"$VERSION".json
sbom-utility validate --input-file sbom_backend_application_"$VERSION".json
-
name: Generate SBOM for frontend application
env:
VERSION: ${{ github.event.inputs.release }}
working-directory: ./sbom
run: |
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_frontend_application.json
cyclonedx-npm --omit dev --package-lock-only --spec-version 1.5 --output-format JSON ../frontend/package-lock.json \
| parlay ecosystems enrich - \
| sbom-utility trim --keys=externalReferences,properties,vulnerabilities --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_frontend_application.json --quiet --input-file - --output-file sbom_frontend_application_"$VERSION".json
sbom-utility validate --input-file sbom_frontend_application_"$VERSION".json
-
name: Generate SBOM for backend container
env:
VERSION: ${{ github.event.inputs.release }}
working-directory: ./sbom
run: |
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_backend_container.json
trivy image --vuln-type os --scanners license --format cyclonedx --quiet maibornwolff/secobserve-backend:"$VERSION" \
| parlay ecosystems enrich - \
| sbom-utility trim --keys=externalReferences,properties,vulnerabilities --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_backend_container.json --quiet --input-file - --output-file sbom_backend_container_"$VERSION".json
sbom-utility validate --input-file sbom_backend_container_"$VERSION".json
-
name: Generate SBOM for frontend container
env:
VERSION: ${{ github.event.inputs.release }}
working-directory: ./sbom
run: |
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_frontend_container.json
trivy image --vuln-type os --scanners license --format cyclonedx --quiet maibornwolff/secobserve-frontend:"$VERSION" \
| parlay ecosystems enrich - \
| sbom-utility trim --keys=externalReferences,properties,vulnerabilities --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_frontend_container.json --quiet --input-file - --output-file sbom_frontend_container_"$VERSION".json
sbom-utility validate --input-file sbom_frontend_container_"$VERSION".json
-
name: Merge SBOMs
env:
VERSION: ${{ github.event.inputs.release }}
working-directory: ./sbom
run: |
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_complete.json
cyclonedx merge --hierarchical --name "SecObserve" --version "$VERSION" --input-files sbom_backend_application_"$VERSION".json sbom_frontend_application_"$VERSION".json sbom_backend_container_"$VERSION".json sbom_frontend_container_"$VERSION".json --output-format json \
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
| sbom-utility patch --patch-file ./configuration/patch_complete.json --quiet --input-file - --output-file sbom_"$VERSION".json
sbom-utility validate --input-file sbom_"$VERSION".json
-
name: Commit SBOMs
uses: stefanzweifel/git-auto-commit-action@8756aa072ef5b4a080af5dc8fef36c5d586e521d # v5
with:
skip_fetch: true
create_branch: true
commit_message: "chore: generate SBOMs for release ${{ github.event.inputs.release }}"
branch: "chore/sboms_release_${{ github.event.inputs.release }}"
file_pattern: "sbom/sbom*.json"