Skip to content

Commit 345155d

Browse files
tsteenbetsteenbe
committed
Add workflows to test the ORT to ScanCode.io integration
Resolves #1727 #1884. Signed-off-by: Thomas Steenbergen <[email protected]>
1 parent 32d38e2 commit 345155d

File tree

1 file changed

+350
-6
lines changed

1 file changed

+350
-6
lines changed

‎.github/workflows/sca-integration-ort.yml‎

Lines changed: 350 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
name: Generate SBOM with ORT and load into ScanCode.io
1+
name: Generate or load SBOMs from ORT into ScanCode.io
22

33
# This workflow:
4-
# 1. Generates a CycloneDX SBOM for a requirement.txt file using ORT.
5-
# 2. Uploads the SBOM as a GitHub artifact for future inspection.
4+
# 1. Generates CycloneDX and SPDX SBOM with ORT, or
5+
# 2. Loads ORT SBOM test assests
66
# 3. Loads the SBOM into ScanCode.io for further analysis.
77
# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
88
#
@@ -22,7 +22,95 @@ permissions:
2222
contents: read
2323

2424
jobs:
25-
generate-and-load-sbom:
25+
checkout-ort-test-assests-from-scancode-io-repo:
26+
runs-on: ubuntu-24.04
27+
steps:
28+
- name: Checkout ScanCode.io repository
29+
uses: actions/checkout@v5
30+
31+
- name: Upload orthw mime types example
32+
uses: actions/upload-artifact@v4
33+
with:
34+
name: npm-mime-types-2.1.26-scan-result.json
35+
path: scanpipe/tests/data/integrations-ort/orthw-example-scan-result/npm-mime-types-2.1.26-scan-result.json
36+
overwrite: true
37+
retention-days: 1
38+
39+
- name: Upload CycloneDX v1.6 ORT test result
40+
uses: actions/upload-artifact@v4
41+
with:
42+
name: ort-cyclonedx-1.6-result.cyclonedx.json
43+
path: scanpipe/tests/data/integrations-ort/ort-reporter-cyclonedx-1.6-funtest-resources/cyclonedx-reporter-expected-result.json
44+
overwrite: true
45+
retention-days: 1
46+
47+
- name: Upload CycloneDX v1.6 ORT test result with findings
48+
uses: actions/upload-artifact@v4
49+
with:
50+
name: ort-cyclonedx-1.6-result-with-findings.cyclonedx.json
51+
path: scanpipe/tests/data/integrations-ort/ort-reporter-cyclonedx-1.6-funtest-resources/cyclonedx-reporter-expected-result-with-findings.json
52+
overwrite: true
53+
retention-days: 1
54+
55+
- name: Upload CycloneDX v1.6 ORT test result without findings
56+
uses: actions/upload-artifact@v4
57+
with:
58+
name: ort-cyclonedx-1.6-result-without-findings.cyclonedx.json
59+
path: scanpipe/tests/data/integrations-ort/ort-reporter-cyclonedx-1.6-funtest-resources/cyclonedx-reporter-expected-result-without-findings.json
60+
overwrite: true
61+
retention-days: 1
62+
63+
- name: Upload SPDX v2.2 ORT test result
64+
uses: actions/upload-artifact@v4
65+
with:
66+
name: ort-spdx-2.2-result.spdx.json
67+
path: scanpipe/tests/data/integrations-ort/ort-reporter-spdx-2.2-funtest-resources/synthetic-scan-result-expected-output.spdx.json
68+
overwrite: true
69+
retention-days: 1
70+
71+
- name: Upload SPDX v2.3 ORT test result
72+
uses: actions/upload-artifact@v4
73+
with:
74+
name: ort-spdx-2.3-result.spdx.json
75+
path: scanpipe/tests/data/integrations-ort/ort-reporter-spdx-2.3-funtest-resources/synthetic-scan-result-expected-output.spdx.json
76+
overwrite: true
77+
retention-days: 1
78+
79+
generate-python-cyclonedx-1-5-sbom-with-ort-load-into-scancode-io:
80+
runs-on: ubuntu-24.04
81+
steps:
82+
- name: Create a Python requirements.txt
83+
run: |
84+
cat << 'EOF' > requirements.txt
85+
click==6.7
86+
Flask==1.0
87+
itsdangerous==0.24
88+
EOF
89+
90+
- name: Run GitHub Action for ORT
91+
uses: oss-review-toolkit/ort-ci-github-action@main
92+
with:
93+
ort-cli-report-args: "-O CycloneDX=output.file.formats=json -O CycloneDX=schema.version=1.5"
94+
report-formats: "CycloneDx"
95+
run: >
96+
analyzer,
97+
evaluator,
98+
advisor,
99+
reporter
100+
101+
- name: Import SBOM into ScanCode.io
102+
uses: aboutcode-org/scancode-action@main
103+
with:
104+
pipelines: "load_sbom"
105+
inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
106+
scancodeio-repo-branch: "main"
107+
108+
- name: Verify SBOM analysis results in ScanCode.io
109+
shell: bash
110+
run: |
111+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 6; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 5"
112+
113+
generate-python-cyclonedx-1-6-sbom-with-ort-load-into-scancode-io:
26114
runs-on: ubuntu-24.04
27115
steps:
28116
- name: Create a Python requirements.txt
@@ -35,7 +123,15 @@ jobs:
35123
EOF
36124
37125
- name: Run GitHub Action for ORT
38-
uses: oss-review-toolkit/ort-ci-github-action@v1
126+
uses: oss-review-toolkit/ort-ci-github-action@main
127+
with:
128+
ort-cli-report-args: "-O CycloneDX=output.file.formats=json -O CycloneDX=schema.version=1.6"
129+
report-formats: "CycloneDx"
130+
run: >
131+
analyzer,
132+
evaluator,
133+
advisor,
134+
reporter
39135
40136
- name: Import SBOM into ScanCode.io
41137
uses: aboutcode-org/scancode-action@main
@@ -44,7 +140,255 @@ jobs:
44140
inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
45141
scancodeio-repo-branch: "main"
46142

47-
- name: Verify SBOM Analysis Results in ScanCode.io
143+
- name: Verify SBOM analysis results in ScanCode.io
48144
shell: bash
49145
run: |
50146
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 5; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 1"
147+
148+
generate-mime-types-sboms-from-ort-from-scan-result:
149+
needs: checkout-ort-test-assests-from-scancode-io-repo
150+
runs-on: ubuntu-24.04
151+
steps:
152+
- name: Download mime-type-2.1.26-scan-result file
153+
uses: actions/download-artifact@v5
154+
with:
155+
name: npm-mime-types-2.1.26-scan-result.json
156+
157+
- name: Move mime-types scan result expected location by GitHub Action for ORT
158+
run: |
159+
mkdir -p $HOME/.ort/ort-results/
160+
mv npm-mime-types-2.1.26-scan-result.json \
161+
$HOME/.ort/ort-results/current-result.json
162+
cat $HOME/.ort/ort-results/current-result.json
163+
164+
- name: Run GitHub Action for ORT
165+
uses: oss-review-toolkit/ort-ci-github-action@main
166+
with:
167+
report-formats: "CycloneDx,SpdxDocument"
168+
run: >
169+
evaluator,
170+
advisor,
171+
reporter
172+
- name: Upload orthw mime type example
173+
174+
- uses: actions/upload-artifact@v4
175+
with:
176+
name: npm-mime-types-2.1.26-ort-sboms
177+
path: |
178+
${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json
179+
${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.xml
180+
${{ env.ORT_RESULTS_PATH }}/bom.spdx.json
181+
${{ env.ORT_RESULTS_PATH }}/bom.spdx.yml
182+
overwrite: true
183+
retention-days: 1
184+
185+
load-ort-cyclonedx-1-6-json-into-scancode-io:
186+
needs: checkout-ort-test-assests-from-scancode-io-repo
187+
runs-on: ubuntu-24.04
188+
steps:
189+
- name: Download ORT CycloneDX JSON SBOM
190+
uses: actions/download-artifact@v5
191+
with:
192+
name: ort-cyclonedx-1.6-result.cyclonedx.json
193+
194+
- name: Import SBOM into ScanCode.io
195+
uses: aboutcode-org/scancode-action@main
196+
with:
197+
pipelines: "load_sbom"
198+
inputs-path: "cyclonedx-reporter-expected-result.json"
199+
output-formats: "cyclonedx"
200+
scancodeio-repo-branch: "main"
201+
202+
- name: Verify SBOM analysis results in ScanCode.io
203+
shell: bash
204+
run: |
205+
# FIXME ScanCode.io incorrectly flag CVE-2021-1234 as applicable to this scan.
206+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 5; assert package_manager.vulnerable().count() >= 1; assert DiscoveredDependency.objects.count() >= 0"
207+
208+
load-ort-cyclonedx-1-6-json-sbom-with-findings-into-scancode-io:
209+
needs: checkout-ort-test-assests-from-scancode-io-repo
210+
runs-on: ubuntu-24.04
211+
steps:
212+
- name: Download ORT CycloneDX v1.6 JSON SBOM
213+
uses: actions/download-artifact@v5
214+
with:
215+
name: ort-cyclonedx-1.6-result-with-findings.cyclonedx.json
216+
217+
- name: Import SBOM into ScanCode.io
218+
uses: aboutcode-org/scancode-action@main
219+
with:
220+
pipelines: "load_sbom"
221+
inputs-path: "cyclonedx-reporter-expected-result-with-findings.json"
222+
output-formats: "cyclonedx"
223+
scancodeio-repo-branch: "main"
224+
225+
- name: Verify SBOM analysis results in ScanCode.io
226+
shell: bash
227+
run: |
228+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >=5; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 0"
229+
230+
load-ort-cyclonedx-1-6-json-sbom-without-findings-into-scancode-io:
231+
needs: checkout-ort-test-assests-from-scancode-io-repo
232+
runs-on: ubuntu-24.04
233+
steps:
234+
- name: Download ORT CycloneDX v1.6 JSON SBOM
235+
uses: actions/download-artifact@v5
236+
with:
237+
name: ort-cyclonedx-1.6-result-without-findings.cyclonedx.json
238+
239+
- name: Import SBOM into ScanCode.io
240+
uses: aboutcode-org/scancode-action@main
241+
with:
242+
pipelines: "load_sbom"
243+
inputs-path: "cyclonedx-reporter-expected-result-without-findings.json"
244+
output-formats: "cyclonedx"
245+
scancodeio-repo-branch: "main"
246+
247+
- name: Verify SBOM analysis results in ScanCode.io
248+
shell: bash
249+
run: |
250+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() == 0; assert package_manager.vulnerable().count() == 0; assert DiscoveredDependency.objects.count() == 0"
251+
252+
load-ort-spdx-2-2-json-sbom-into-scancode-io:
253+
needs: checkout-ort-test-assests-from-scancode-io-repo
254+
runs-on: ubuntu-24.04
255+
steps:
256+
- name: Download ORT SPDX v2.2 JSON SBOM
257+
uses: actions/download-artifact@v5
258+
with:
259+
name: ort-spdx-2.2-result.spdx.json
260+
261+
- name: Import SBOM into ScanCode.io
262+
uses: aboutcode-org/scancode-action@main
263+
with:
264+
pipelines: "load_sbom"
265+
inputs-path: "synthetic-scan-result-expected-output.spdx.json"
266+
output-formats: "spdx"
267+
scancodeio-repo-branch: "main"
268+
269+
- name: Verify SBOM analysis results in ScanCode.io
270+
shell: bash
271+
run: |
272+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 12; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 11"
273+
274+
load-ort-spdx-2-3-json-sbom-into-scancode-io:
275+
needs: checkout-ort-test-assests-from-scancode-io-repo
276+
runs-on: ubuntu-24.04
277+
steps:
278+
- name: Download ORT SPDX v2.3 JSON SBOM
279+
uses: actions/download-artifact@v5
280+
with:
281+
name: ort-spdx-2.3-result.spdx.json
282+
283+
- name: Import SBOM into ScanCode.io
284+
uses: aboutcode-org/scancode-action@main
285+
with:
286+
pipelines: "load_sbom"
287+
inputs-path: "synthetic-scan-result-expected-output.spdx.json"
288+
output-formats: "spdx"
289+
scancodeio-repo-branch: "main"
290+
291+
- name: Verify SBOM analysis results in ScanCode.io
292+
shell: bash
293+
run: |
294+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 12; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 11"
295+
296+
load-ort-mime-types-cyclonedx-json-sbom-into-scancode-io:
297+
needs: generate-mime-types-sboms-from-ort-from-scan-result
298+
runs-on: ubuntu-24.04
299+
steps:
300+
- name: Download ORT CycloneDX JSON SBOM for mime-types 2.1.26
301+
uses: actions/download-artifact@v5
302+
with:
303+
name: npm-mime-types-2.1.26-ort-sboms
304+
305+
- name: Import SBOM into ScanCode.io
306+
uses: aboutcode-org/scancode-action@main
307+
with:
308+
pipelines: "load_sbom"
309+
inputs-path: "bom.cyclonedx.json"
310+
output-formats: "cyclonedx"
311+
scancodeio-repo-branch: "main"
312+
313+
- name: Verify SBOM analysis results in ScanCode.io
314+
shell: bash
315+
run: |
316+
# FIXME Number of packages and dependencies detected is wrong
317+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 380; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 628"
318+
319+
# FIXME: Loading CycloneDX SBOM in YAML format fails for unclear reasons.
320+
#
321+
# load-ort-mime-types-cyclonedx-xml-sbom-into-scancode-io:
322+
# needs: generate-mime-types-sboms-from-ort-from-scan-result
323+
# runs-on: ubuntu-24.04
324+
# steps:
325+
# - name: Download ORT CycloneDX JSON SBOM for mime-types 2.1.26
326+
# uses: actions/download-artifact@v5
327+
# with:
328+
# name: npm-mime-types-2.1.26-ort-sboms
329+
330+
# - name: Import SBOM into ScanCode.io
331+
# uses: aboutcode-org/scancode-action@main
332+
# with:
333+
# pipelines: "load_sbom"
334+
# inputs-path: "bom.cyclonedx.xml"
335+
# output-formats: "cyclonedx"
336+
# scancodeio-repo-branch: "main"
337+
338+
# - name: Verify SBOM analysis results in ScanCode.io
339+
# shell: bash
340+
# run: |
341+
# # FIXME Number of packages and dependencies detected is wrong
342+
# scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 405; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 0"
343+
344+
load-mime-types-spdx-json-sbom-into-scancode-io:
345+
needs: generate-mime-types-sboms-from-ort-from-scan-result
346+
runs-on: ubuntu-24.04
347+
steps:
348+
- name: Download ORT SPDX JSON SBOM for mime-types 2.1.26
349+
uses: actions/download-artifact@v5
350+
with:
351+
name: npm-mime-types-2.1.26-ort-sboms
352+
353+
- name: Cat SPDX JSON - for debugging purposes only, remove ASAP
354+
run: |
355+
cat bom.spdx.json
356+
357+
- name: Import SBOM into ScanCode.io
358+
uses: aboutcode-org/scancode-action@main
359+
with:
360+
pipelines: "load_sbom"
361+
inputs-path: "bom.spdx.json"
362+
output-formats: "spdx"
363+
scancodeio-repo-branch: "main"
364+
365+
- name: Verify SBOM analysis results in ScanCode.io
366+
shell: bash
367+
run: |
368+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 1141; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 1,397"
369+
370+
load-mime-types-spdx-yml-sbom-into-scancode-io:
371+
needs: generate-mime-types-sboms-from-ort-from-scan-result
372+
runs-on: ubuntu-24.04
373+
steps:
374+
- name: Download ORT SPDX YAML SBOM for mime-types 2.1.26
375+
uses: actions/download-artifact@v5
376+
with:
377+
name: npm-mime-types-2.1.26-ort-sboms
378+
379+
- name: Cat SPDX YAML - for debugging purposes only, remove ASAP
380+
run: |
381+
cat bom.spdx.yml
382+
383+
- name: Import SBOM into ScanCode.io
384+
uses: aboutcode-org/scancode-action@main
385+
with:
386+
pipelines: "load_sbom"
387+
inputs-path: "bom.spdx.yml"
388+
output-formats: "spdx"
389+
scancodeio-repo-branch: "main"
390+
391+
- name: Verify SBOM analysis results in ScanCode.io
392+
shell: bash
393+
run: |
394+
scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; assert package_manager.count() >= 1141; assert package_manager.vulnerable().count() >= 0; assert DiscoveredDependency.objects.count() >= 1,397"

0 commit comments

Comments
 (0)