Skip to content

Commit 4828c60

Browse files
tdrueztdruez
authored
Initial implementation of the scancode-action (#2)
Signed-off-by: Thomas Druez <tdruez@nexb.com>
1 parent 1dfccd9 commit 4828c60

5 files changed

Lines changed: 349 additions & 2 deletions

File tree

‎.github/workflows/scan-codebase.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
on: [push]
2+
3+
jobs:
4+
scan-codebase:
5+
runs-on: ubuntu-latest
6+
name: Scan codebase with ScanCode.io
7+
steps:
8+
- uses: actions/checkout@v4
9+
with:
10+
path: scancode-inputs
11+
- uses: nexB/scancode-action@alpha
12+
with:
13+
pipelines: "scan_codebase,find_vulnerabilities"
14+
env:
15+
VULNERABLECODE_URL: https://public.vulnerablecode.io/

‎.github/workflows/scan-package.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
on: [push]
2+
3+
jobs:
4+
scan-codebase:
5+
runs-on: ubuntu-latest
6+
name: Scan package with ScanCode.io
7+
steps:
8+
- name: Download repository archive to scancode-inputs/ directory
9+
run: |
10+
wget --directory-prefix=scancode-inputs https://github.com/${GITHUB_REPOSITORY}/archive/${GITHUB_REF}.zip
11+
- uses: nexB/scancode-action@alpha
12+
with:
13+
pipelines: "scan_package"

‎.gitignore‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Ignore node_modules, ncc is used to compile nodejs modules into a single file in the releases branch
2+
node_modules/
3+
__tests__/runner/*
4+
5+
# Ignore js files that are transpiled from ts files in src/
6+
lib/
7+
8+
# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
9+
# Logs
10+
logs
11+
*.log
12+
npm-debug.log*
13+
yarn-debug.log*
14+
yarn-error.log*
15+
lerna-debug.log*
16+
17+
# Diagnostic reports (https://nodejs.org/api/report.html)
18+
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
19+
20+
# Runtime data
21+
pids
22+
*.pid
23+
*.seed
24+
*.pid.lock
25+
26+
# Directory for instrumented libs generated by jscoverage/JSCover
27+
lib-cov
28+
29+
# Coverage directory used by tools like istanbul
30+
coverage
31+
*.lcov
32+
33+
# nyc test coverage
34+
.nyc_output
35+
36+
# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
37+
.grunt
38+
39+
# Bower dependency directory (https://bower.io/)
40+
bower_components
41+
42+
# node-waf configuration
43+
.lock-wscript
44+
45+
# Compiled binary addons (https://nodejs.org/api/addons.html)
46+
build/Release
47+
48+
# Dependency directories
49+
jspm_packages/
50+
51+
# TypeScript v1 declaration files
52+
typings/
53+
54+
# TypeScript cache
55+
*.tsbuildinfo
56+
57+
# Optional npm cache directory
58+
.npm
59+
60+
# Optional eslint cache
61+
.eslintcache
62+
63+
# Optional REPL history
64+
.node_repl_history
65+
66+
# Output of 'npm pack'
67+
*.tgz
68+
69+
# Yarn Integrity file
70+
.yarn-integrity
71+
72+
# dotenv environment variables file
73+
.env
74+
.env.test
75+
76+
# parcel-bundler cache (https://parceljs.org/)
77+
.cache
78+
79+
# next.js build output
80+
.next
81+
82+
# nuxt.js build output
83+
.nuxt
84+
85+
# vuepress build output
86+
.vuepress/dist
87+
88+
# Serverless directories
89+
.serverless/
90+
91+
# FuseBox cache
92+
.fusebox/
93+
94+
# DynamoDB Local files
95+
.dynamodb/
96+
97+
# Editor
98+
.idea

‎README.md‎

Lines changed: 140 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,140 @@
1-
# scancode-action
2-
Run ScanCode scan in your workflow
1+
# `@nexB/scancode-action`
2+
3+
Run [ScanCode.io](https://github.com/nexB/scancode.io) pipelines from your Workflows.
4+
5+
> [!IMPORTANT]
6+
> The scancode-action is currently in the **alpha stage**, and we invite you to
7+
> contribute to its improvement. Please feel free to submit bug reports or share
8+
> your ideas by creating new entries in the "Issues" section.
9+
> Your collaboration helps us enhance the action and ensures a more stable and
10+
> effective tool for the community.
11+
> Thank you for your support!
12+
13+
- [Usage](#usage)
14+
- [Basic](#basic)
15+
- [Inputs](#inputs)
16+
- [Examples](#examples)
17+
- [Scan repo codebase](#scan-repo-codebase)
18+
- [Run a specific pipeline](#run-a-specific-pipeline)
19+
- [Run multiple pipelines](#run-multiple-pipelines)
20+
- [Choose the output formats](#choose-the-output-formats)
21+
- [Fetch pipelines inputs](#fetch-pipelines-inputs)
22+
- [Define a custom project name](#define-a-custom-project-name)
23+
- [Where does the scan results go?](#where-does-the-scan-results-go)
24+
25+
## Usage
26+
27+
### Basic
28+
29+
```yaml
30+
steps:
31+
- uses: actions/checkout@v4
32+
with:
33+
path: scancode-inputs
34+
- uses: nexB/scancode-action@alpha
35+
with:
36+
pipelines: "scan_codebase"
37+
output-formats: "json xlsx spdx cyclonedx"
38+
```
39+
40+
### Inputs
41+
42+
```yaml
43+
- uses: nexB/scancode-action@alpha
44+
with:
45+
# Names of the pipelines (comma-separated) and in order.
46+
# Default is 'scan_codebase'
47+
pipelines:
48+
49+
# The list of output formats to generate.
50+
# Default is 'json xlsx spdx cyclonedx'
51+
output-formats:
52+
53+
# Relative path within the $GITHUB_WORKSPACE for pipeline inputs.
54+
# Default is 'scancode-inputs'
55+
inputs-path:
56+
57+
# Name of the project.
58+
# Default is 'scancode-action'
59+
project-name:
60+
61+
# Python version that will be installed to run ScanCode.io
62+
# Default is '3.11'
63+
python-version:
64+
```
65+
66+
## Examples
67+
68+
### Scan repo codebase
69+
70+
```yaml
71+
steps:
72+
- uses: actions/checkout@v4
73+
with:
74+
path: scancode-inputs
75+
- uses: nexB/scancode-action@alpha
76+
```
77+
78+
### Run a specific pipeline
79+
80+
[Built-in pipelines list](https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html)
81+
82+
```yaml
83+
- uses: nexB/scancode-action@alpha
84+
with:
85+
pipelines: "scan_codebase"
86+
```
87+
88+
### Run multiple pipelines
89+
90+
```yaml
91+
- uses: nexB/scancode-action@alpha
92+
with:
93+
pipelines: "scan_codebase,find_vulnerabilities"
94+
env:
95+
VULNERABLECODE_URL: https://public.vulnerablecode.io/
96+
```
97+
98+
#### Configuring `find_vulnerabilities` Pipeline
99+
100+
The `find_vulnerabilities` pipeline requires access to a VulnerableCode instance,
101+
which can be defined using the `VULNERABLECODE_URL` environment variable.
102+
103+
In the example provided, a public instance is referenced.
104+
However, you also have the option to run your own VulnerableCode instance.
105+
For details on setting up and configuring your own instance, please refer to the
106+
[VulnerableCode documentation](https://vulnerablecode.readthedocs.io/en/latest/index.html).
107+
108+
### Choose the output formats
109+
110+
```yaml
111+
- uses: nexB/scancode-action@alpha
112+
with:
113+
output-formats: "json xlsx spdx cyclonedx"
114+
```
115+
116+
### Fetch pipelines inputs
117+
118+
```yaml
119+
- name: Download repository archive to scancode-inputs/ directory
120+
run: |
121+
wget --directory-prefix=scancode-inputs https://github.com/${GITHUB_REPOSITORY}/archive/${GITHUB_REF}.zip
122+
- uses: nexB/scancode-action@alpha
123+
with:
124+
pipelines: "scan_single_package"
125+
```
126+
127+
### Define a custom project name
128+
129+
```yaml
130+
- uses: nexB/scancode-action@alpha
131+
with:
132+
project-name: "my-project-name"
133+
```
134+
135+
## Where are the Scan Results?
136+
137+
Upon completion of the workflow, you can **find the scan results** in the dedicated
138+
**artifacts section** at the bottom of the workflow summary page.
139+
Look for a file named `scanpipe-outputs` in that section.
140+
This file contains the outputs generated by the `scancode-action`.

‎action.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: "ScanCode action"
2+
description: "Run ScanCode.io pipelines in your workflows"
3+
inputs:
4+
pipelines:
5+
description: "Names of the pipelines (comma-separated) and in order."
6+
default: "scan_codebase"
7+
output-formats:
8+
description: "Output formats"
9+
default: "json xlsx spdx cyclonedx"
10+
inputs-path:
11+
description: "Relative path within the $GITHUB_WORKSPACE for pipeline inputs"
12+
default: "${{ github.workspace }}/scancode-inputs"
13+
project-name:
14+
description: "Name of the project"
15+
default: "scancode-action"
16+
python-version:
17+
description: "Python version"
18+
default: "3.11"
19+
20+
runs:
21+
using: "composite"
22+
steps:
23+
- uses: actions/setup-python@v5
24+
with:
25+
python-version: ${{ inputs.python-version }}
26+
27+
- name: Set up environment
28+
shell: bash
29+
run: |
30+
echo "SECRET_KEY=$(openssl rand -base64 32)" >> $GITHUB_ENV
31+
echo "SCANCODEIO_DB_ENGINE=django.db.backends.sqlite3" >> $GITHUB_ENV
32+
echo "SCANCODEIO_DB_NAME=sqlite3.db" >> $GITHUB_ENV
33+
34+
- name: Install ScanCode.io
35+
shell: bash
36+
run: |
37+
pip install scancodeio
38+
scanpipe migrate
39+
40+
- name: Generate pipelines CLI arguments
41+
shell: bash
42+
run: |
43+
IFS=',' read -ra PIPELINES <<< "${{ inputs.pipelines }}"
44+
options=""
45+
for pipeline in "${PIPELINES[@]}"; do
46+
options+="--pipeline $pipeline "
47+
done
48+
echo "PIPELINE_CLI_ARGS=${options}" >> $GITHUB_ENV
49+
50+
- name: Create project with ${{ inputs.pipelines }} pipelines
51+
shell: bash
52+
run: |
53+
scanpipe create-project ${{ inputs.project-name }} ${{ env.PIPELINE_CLI_ARGS }}
54+
55+
- name: Set project work directory in the environment
56+
shell: bash
57+
run: |
58+
project_status=$(scanpipe status --project ${{ inputs.project-name }})
59+
work_directory=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+')
60+
echo "PROJECT_WORK_DIRECTORY=$work_directory" >> $GITHUB_ENV
61+
62+
- name: Copy input files to project work directory
63+
shell: bash
64+
run: cp -r ${{ inputs.inputs-path }}/* ${{ env.PROJECT_WORK_DIRECTORY }}/input/
65+
66+
- name: Run the pipelines
67+
shell: bash
68+
run: scanpipe execute --project ${{ inputs.project-name }} --no-color
69+
70+
- name: Generate outputs
71+
id: scanpipe
72+
shell: bash
73+
run: scanpipe output
74+
--project ${{ inputs.project-name }}
75+
--format ${{ inputs.output-formats }}
76+
--no-color
77+
78+
- name: Upload outputs
79+
uses: actions/upload-artifact@v4
80+
id: artifact-upload-step
81+
with:
82+
name: scanpipe-outputs
83+
path: ${{ env.PROJECT_WORK_DIRECTORY }}/output/*

0 commit comments

Comments
 (0)