File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change 1- name : Generate SBOM with Trivy
1+ name : Generate SBOM with Trivy and load in ScanCode.io
22
33on :
44 workflow_dispatch :
1414 IMAGE_REFERENCE : " python:3.13.0-slim"
1515
1616jobs :
17- generate-sbom :
17+ generate-and-load- sbom :
1818 runs-on : ubuntu-24.04
1919 steps :
2020 - name : Run Trivy in CycloneDX SBOM mode
@@ -27,20 +27,20 @@ jobs:
2727 scanners : " vuln,license"
2828 version : " latest"
2929
30- - name : Upload Trivy report as a Github artifact
30+ - name : Upload Trivy SBOM as a Github artifact
3131 uses : actions/upload-artifact@v4
3232 with :
3333 name : upload-trivy-sbom-report
3434 path : " ${{ github.workspace }}/trivy-report.sbom.json"
3535 retention-days : 20
3636
37- - name : Load the Trivy report SBOM into ScanCode.io
37+ - name : Load the Trivy SBOM into ScanCode.io
3838 uses : aboutcode-org/scancode-action@file-as-inputs-path
3939 with :
4040 pipelines : " load_sbom"
4141 inputs-path : " ${{ github.workspace }}/trivy-report.sbom.json"
4242
43- - name : Test running scanpipe for checking the loaded content
43+ - name : Check the SBOM was properly loaded in ScanCode.io
4444 shell : bash
4545 run : |
4646 scanpipe shell --command "from scanpipe.models import DiscoveredPackage; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 90; assert package_manager.vulnerable().count() > 40;"
You can’t perform that action at this time.
0 commit comments