From e57f3f970df38d516dab4da84ea16c085f136e7a Mon Sep 17 00:00:00 2001 From: NucleonGodX Date: Wed, 16 Jul 2025 22:27:55 +0530 Subject: [PATCH 1/3] add support for azure pipelines Signed-off-by: NucleonGodX --- .github/workflows/analyze-docker-image.yml | 18 ++ .github/workflows/find-vulnerabilities.yml | 24 +++ .github/workflows/map-deploy-to-develop.yml | 21 ++ .github/workflows/scan-codebase.yml | 21 ++ .github/workflows/scan-single-package.yml | 18 ++ .gitignore | 101 +++++++++ README.md | 224 +++++++++++++++++++- action.yml | 157 ++++++++++++++ azure-pipelines/examples/scan-codebase.yml | 18 ++ azure-pipelines/scancode-template.yml | 161 ++++++++++++++ 10 files changed, 761 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/analyze-docker-image.yml create mode 100644 .github/workflows/find-vulnerabilities.yml create mode 100644 .github/workflows/map-deploy-to-develop.yml create mode 100644 .github/workflows/scan-codebase.yml create mode 100644 .github/workflows/scan-single-package.yml create mode 100644 .gitignore create mode 100644 action.yml create mode 100644 azure-pipelines/examples/scan-codebase.yml create mode 100644 azure-pipelines/scancode-template.yml diff --git a/.github/workflows/analyze-docker-image.yml b/.github/workflows/analyze-docker-image.yml new file mode 100644 index 0000000..e88e1cc --- /dev/null +++ b/.github/workflows/analyze-docker-image.yml @@ -0,0 +1,18 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-24.04 + name: Analyze a Docker image + steps: + - name: Get the action.yml from the current branch + uses: actions/checkout@v4 + with: + sparse-checkout: action.yml + sparse-checkout-cone-mode: false + + - uses: ./ + with: + pipelines: "analyze_docker_image" + input-urls: + https://github.com/aboutcode-org/scancode.io-tutorial/releases/download/sample-images/30-alpine-nickolashkraus-staticbox-latest.tar diff --git a/.github/workflows/find-vulnerabilities.yml b/.github/workflows/find-vulnerabilities.yml new file mode 100644 index 0000000..ec39fdc --- /dev/null +++ b/.github/workflows/find-vulnerabilities.yml @@ -0,0 +1,24 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-24.04 + name: Scan codebase and find vulnerabilities + steps: + - name: Get the action.yml from the current branch + uses: actions/checkout@v4 + with: + sparse-checkout: action.yml + sparse-checkout-cone-mode: false + + - uses: actions/checkout@v4 + with: + path: scancode-inputs + - uses: ./ + with: + pipelines: "scan_codebase,find_vulnerabilities" + scancodeio-repo-branch: "main" + check-compliance: true + compliance-fail-on-vulnerabilities: true + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ diff --git a/.github/workflows/map-deploy-to-develop.yml b/.github/workflows/map-deploy-to-develop.yml new file mode 100644 index 0000000..09ab26e --- /dev/null +++ b/.github/workflows/map-deploy-to-develop.yml @@ -0,0 +1,21 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-24.04 + name: Map deploy to develop + steps: + - name: Get the action.yml from the current branch + uses: actions/checkout@v4 + with: + sparse-checkout: action.yml + sparse-checkout-cone-mode: false + + - uses: ./ + with: + pipelines: "map_deploy_to_develop" + input-urls: + https://github.com/aboutcode-org/scancode.io/raw/main/scanpipe/tests/data/d2d/jars/from-flume-ng-node-1.9.0.zip#from + https://github.com/aboutcode-org/scancode.io/raw/main/scanpipe/tests/data/d2d/jars/to-flume-ng-node-1.9.0.zip#to + env: + PURLDB_URL: https://public.purldb.io/ diff --git a/.github/workflows/scan-codebase.yml b/.github/workflows/scan-codebase.yml new file mode 100644 index 0000000..0c02e8b --- /dev/null +++ b/.github/workflows/scan-codebase.yml @@ -0,0 +1,21 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-24.04 + name: Scan codebase and check for compliance issues + steps: + - name: Get the action.yml from the current branch + uses: actions/checkout@v4 + with: + sparse-checkout: action.yml + sparse-checkout-cone-mode: false + + - uses: actions/checkout@v4 + with: + path: scancode-inputs + - uses: ./ + with: + pipelines: "scan_codebase" + check-compliance: true + compliance-fail-level: "WARNING" diff --git a/.github/workflows/scan-single-package.yml b/.github/workflows/scan-single-package.yml new file mode 100644 index 0000000..a9d090b --- /dev/null +++ b/.github/workflows/scan-single-package.yml @@ -0,0 +1,18 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-24.04 + name: Scan a package archive + steps: + - name: Get the action.yml from the current branch + uses: actions/checkout@v4 + with: + sparse-checkout: action.yml + sparse-checkout-cone-mode: false + + - uses: ./ + with: + pipelines: "scan_single_package" + input-urls: + https://github.com/${GITHUB_REPOSITORY}/archive/${GITHUB_REF}.zip diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b65d707 --- /dev/null +++ b/.gitignore @@ -0,0 +1,101 @@ +# Ignore node_modules, ncc is used to compile nodejs modules into a single file in the releases branch +node_modules/ +__tests__/runner/* + +# Ignore js files that are transpiled from ts files in src/ +lib/ + +# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore +# Logs +logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* +lerna-debug.log* + +# Diagnostic reports (https://nodejs.org/api/report.html) +report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json + +# Runtime data +pids +*.pid +*.seed +*.pid.lock + +# Directory for instrumented libs generated by jscoverage/JSCover +lib-cov + +# Coverage directory used by tools like istanbul +coverage +*.lcov + +# nyc test coverage +.nyc_output + +# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files) +.grunt + +# Bower dependency directory (https://bower.io/) +bower_components + +# node-waf configuration +.lock-wscript + +# Compiled binary addons (https://nodejs.org/api/addons.html) +build/Release + +# Dependency directories +jspm_packages/ + +# TypeScript v1 declaration files +typings/ + +# TypeScript cache +*.tsbuildinfo + +# Optional npm cache directory +.npm + +# Optional eslint cache +.eslintcache + +# Optional REPL history +.node_repl_history + +# Output of 'npm pack' +*.tgz + +# Yarn Integrity file +.yarn-integrity + +# dotenv environment variables file +.env +.env.test + +# parcel-bundler cache (https://parceljs.org/) +.cache + +# next.js build output +.next + +# nuxt.js build output +.nuxt + +# vuepress build output +.vuepress/dist + +# Serverless directories +.serverless/ + +# FuseBox cache +.fusebox/ + +# DynamoDB Local files +.dynamodb/ + +# Editor +.idea + +# Various junk and temp files +.DS_Store diff --git a/README.md b/README.md index 7ac3662..15e4086 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,222 @@ -# scancode-action -Run ScanCode scan in your workflow +# `@aboutcode-org/scancode-action` + +Run [ScanCode.io](https://github.com/aboutcode-org/scancode.io) pipelines from your +Workflows. + +> [!IMPORTANT] +> The scancode-action is currently in the **beta stage**, and we invite you to +> contribute to its improvement. Please feel free to submit bug reports or share +> your ideas by creating new entries in the "Issues" section. +> Your collaboration helps us enhance the action and ensures a more stable and +> effective tool for the community. +> Thank you for your support! + +- [Usage](#usage) + - [Basic](#basic) + - [Inputs](#inputs) +- [Examples](#examples) + - [Scan repo codebase](#scan-repo-codebase) + - [Run a specific pipeline](#run-a-specific-pipeline) + - [Run multiple pipelines](#run-multiple-pipelines) + - [Choose the output formats](#choose-the-output-formats) + - [Provide download URLs inputs](#provide-download-urls-inputs) + - [Fetch pipelines inputs](#fetch-pipelines-inputs) + - [Check for compliance issues](#check-for-compliance-issues) + - [Define a custom project name](#define-a-custom-project-name) + - [Install ScanCode.io from a repository branch](#install-scancodeio-from-a-repository-branch) +- [Where does the scan results go?](#where-does-the-scan-results-go) + +## Usage + +### Basic + +```yaml +steps: +- uses: actions/checkout@v4 + with: + path: scancode-inputs +- uses: aboutcode-org/scancode-action@beta + with: + pipelines: "scan_codebase" + output-formats: "json xlsx spdx cyclonedx" +``` + +### Inputs + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + # Names of the pipelines (comma-separated) and in order. + # Default is 'scan_codebase' + pipelines: + + # The list of output formats to generate. + # Default is 'json xlsx spdx cyclonedx' + output-formats: + + # Relative path within the $GITHUB_WORKSPACE for pipeline inputs. + # Default is 'scancode-inputs' + inputs-path: + + # Provide one or more URLs to download for the pipeline run execution + input-urls: + + # Name of the project. + # Default is 'scancode-action' + project-name: + + # Name of the outputs archive. + # Default is 'scancode-outputs' + outputs-archive-name: + + # Check for compliance issues in the project. + # Exits with a non-zero status if compliance issues are detected. + # Default is false + check-compliance: + + # Failure level for compliance check. Options: ERROR, WARNING, MISSING. + # Default is 'ERROR' + compliance-fail-level: + + # Exit with a non-zero status if known vulnerabilities are detected in discovered + # packages and dependencies. + # Default is false + compliance-fail-on-vulnerabilities: + + # Python version that will be installed to run ScanCode.io + # Default is '3.12' + python-version: +``` + +## Examples + +See https://github.com/aboutcode-org/scancode-action/tree/main/.github/workflows for +Workflows examples. + +### Scan repo codebase + +```yaml +steps: +- uses: actions/checkout@v4 + with: + path: scancode-inputs +- uses: aboutcode-org/scancode-action@beta +``` + +### Run a specific pipeline + +[Built-in pipelines list](https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html) + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + pipelines: "scan_codebase" +``` + +### Run multiple pipelines + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + pipelines: "scan_codebase,find_vulnerabilities" + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ +``` + +#### Configuring `find_vulnerabilities` Pipeline + +The `find_vulnerabilities` pipeline requires access to a VulnerableCode instance, +which can be defined using the `VULNERABLECODE_URL` environment variable. + +In the example provided, a public instance is referenced. +However, you also have the option to run your own VulnerableCode instance. +For details on setting up and configuring your own instance, please refer to the +[VulnerableCode documentation](https://vulnerablecode.readthedocs.io/en/latest/index.html). + +#### Fail on known vulnerabilities + +When enabled, the workflow will fail if any known vulnerabilities are found in the +project's discovered packages or dependencies. +Activate this behavior by enabling `check-compliance` and setting +`compliance-fail-on-vulnerabilities` to true. + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + pipelines: "scan_codebase,find_vulnerabilities" + check-compliance: true + compliance-fail-on-vulnerabilities: true + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ +``` + +### Choose the output formats + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + output-formats: "json xlsx spdx cyclonedx" +``` + +> [!NOTE] +> To specify a CycloneDX spec version (default to latest), use the syntax + ``cyclonedx:VERSION`` as format value. For example: ``cyclonedx:1.5``. + +### Provide download URLs inputs + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + pipelines: "map_deploy_to_develop" + input-urls: + https://domain.url/source.zip#from + https://domain.url/binaries.zip#to +``` + +### Fetch pipelines inputs + +```yaml +- name: Download repository archive to scancode-inputs/ directory + run: | + wget --directory-prefix=scancode-inputs https://github.com/${GITHUB_REPOSITORY}/archive/${GITHUB_REF}.zip +- uses: aboutcode-org/scancode-action@beta + with: + pipelines: "scan_single_package" +``` + +### Check for compliance issues + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + check-compliance: true + compliance-fail-level: "WARNING" +``` + +> [!NOTE] +> This feature requires to provide Project policies. +> For details on setting up and configuring your own instance, please refer to the +> [ScanCode.io Policies documentation](https://scancodeio.readthedocs.io/en/latest/policies.html). + +### Define a custom project name + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + project-name: "my-project-name" +``` + +### Install ScanCode.io from a repository branch + +```yaml +- uses: aboutcode-org/scancode-action@beta + with: + scancodeio-repo-branch: "main" +``` + +## Where are the Scan Results? + +Upon completion of the workflow, you can **find the scan results** in the dedicated +**artifacts section** at the bottom of the workflow summary page. +Look for a file named `scancode-outputs` in that section. +This file contains the outputs generated by the `scancode-action`. diff --git a/action.yml b/action.yml new file mode 100644 index 0000000..5c0e93b --- /dev/null +++ b/action.yml @@ -0,0 +1,157 @@ +name: "ScanCode action" +description: "Run ScanCode.io pipelines in your workflows" +inputs: + pipelines: + description: "Names of the pipelines (comma-separated) and in order." + default: "scan_codebase" + output-formats: + description: "Output formats" + default: "json xlsx spdx cyclonedx" + inputs-path: + description: "Relative path within the $GITHUB_WORKSPACE for pipeline inputs" + default: "${{ github.workspace }}/scancode-inputs" + input-urls: + description: "Provide one or more URLs to download for the pipeline run execution." + required: false + default: "" + project-name: + description: "Name of the project." + default: "scancode-action" + outputs-archive-name: + description: "Name of the outputs archive." + default: "scancode-outputs" + check-compliance: + description: | + Check for compliance issues in the project. + Exits with a non-zero status if compliance issues are detected. + required: false + default: "false" + compliance-fail-level: + description: "Failure level for compliance check. Options: ERROR, WARNING, MISSING." + required: false + default: "ERROR" + compliance-fail-on-vulnerabilities: + description: | + Exit with a non-zero status if known vulnerabilities are detected in discovered + packages and dependencies. + required: false + default: "false" + python-version: + description: "Python version." + default: "3.12" + scancodeio-repo-branch: + description: "Branch to install ScanCode.io from the GitHub repository (optional)" + required: false + default: "" + +runs: + using: "composite" + steps: + - uses: actions/setup-python@v5 + with: + python-version: ${{ inputs.python-version }} + + - name: Set up environment + shell: bash + run: | + echo "SECRET_KEY=$(openssl rand -base64 32)" >> $GITHUB_ENV + echo "SCANCODEIO_DB_NAME=scancodeio" >> $GITHUB_ENV + echo "SCANCODEIO_DB_USER=scancodeio" >> $GITHUB_ENV + echo "SCANCODEIO_DB_PASSWORD=scancodeio" >> $GITHUB_ENV + + - name: Start and setup the PostgreSQL service + shell: bash + run: | + sudo systemctl start postgresql.service + sudo -u postgres createuser --no-createrole --no-superuser --login --inherit --createdb ${{ env.SCANCODEIO_DB_USER }} + sudo -u postgres psql -c "ALTER USER ${{ env.SCANCODEIO_DB_USER }} WITH encrypted password '${{ env.SCANCODEIO_DB_PASSWORD }}'" + sudo -u postgres createdb --owner=scancodeio --encoding=UTF-8 ${{ env.SCANCODEIO_DB_NAME }} + + - name: Install ScanCode.io + shell: bash + run: | + if [ -z "${{ inputs.scancodeio-repo-branch }}" ]; then + echo "Installing the latest ScanCode.io release from PyPI" + pip install --upgrade scancodeio + else + echo "Installing ScanCode.io from the GitHub branch: ${{ inputs.scancodeio-repo-branch }}" + pip install git+https://github.com/aboutcode-org/scancode.io.git@${{ inputs.scancodeio-repo-branch }} + fi + + - name: Run migrations to prepare the database + shell: bash + run: scanpipe migrate --verbosity 0 + + - name: Generate `--pipeline` CLI arguments + shell: bash + run: | + IFS=',' read -ra PIPELINES <<< "${{ inputs.pipelines }}" + PIPELINE_CLI_ARGS="" + for pipeline in "${PIPELINES[@]}"; do + PIPELINE_CLI_ARGS+=" --pipeline $pipeline" + done + echo "PIPELINE_CLI_ARGS=${PIPELINE_CLI_ARGS}" >> $GITHUB_ENV + + - name: Generate `--input-url` CLI arguments + shell: bash + run: | + INPUT_URL_CLI_ARGS="" + for url in ${{ inputs.input-urls }}; do + INPUT_URL_CLI_ARGS+=" --input-url $url" + done + echo "INPUT_URL_CLI_ARGS=${INPUT_URL_CLI_ARGS}" >> $GITHUB_ENV + + - name: Create project + shell: bash + run: | + scanpipe create-project ${{ inputs.project-name }} \ + ${{ env.PIPELINE_CLI_ARGS }} \ + ${{ env.INPUT_URL_CLI_ARGS }} + + - name: Set project work directory in the environment + shell: bash + run: | + project_status=$(scanpipe status --project ${{ inputs.project-name }}) + work_directory=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+') + echo "PROJECT_WORK_DIRECTORY=$work_directory" >> $GITHUB_ENV + + - name: Copy input files to project work directory + shell: bash + run: | + SOURCE_PATH="${{ inputs.inputs-path }}" + DESTINATION_PATH="${{ env.PROJECT_WORK_DIRECTORY }}/input/" + if [ -d "$SOURCE_PATH" ]; then + cp -r "$SOURCE_PATH"/* "$DESTINATION_PATH" + fi + + - name: Run the pipelines + shell: bash + run: scanpipe execute --project ${{ inputs.project-name }} --no-color + + - name: Generate outputs + id: scanpipe + shell: bash + run: scanpipe output + --project ${{ inputs.project-name }} + --format ${{ inputs.output-formats }} + + - name: Upload outputs + uses: actions/upload-artifact@v4 + id: artifact-upload-step + with: + name: ${{ inputs.outputs-archive-name }} + path: ${{ env.PROJECT_WORK_DIRECTORY }}/output/* + + - name: Check compliance + if: inputs.check-compliance == 'true' + shell: bash + run: | + cmd="scanpipe check-compliance \ + --project ${{ inputs.project-name }} \ + --fail-level ${{ inputs.compliance-fail-level }}" + + if [[ "${{ inputs.compliance-fail-on-vulnerabilities }}" == "true" ]]; then + cmd="$cmd --fail-on-vulnerabilities" + fi + + eval "$cmd" diff --git a/azure-pipelines/examples/scan-codebase.yml b/azure-pipelines/examples/scan-codebase.yml new file mode 100644 index 0000000..69181c8 --- /dev/null +++ b/azure-pipelines/examples/scan-codebase.yml @@ -0,0 +1,18 @@ +trigger: [push] + +resources: + repositories: + - repository: scancode-action + type: github + name: aboutcode-org/scancode-action + ref: main + +jobs: + - job: scan_codebase + displayName: 'Scan codebase and check for compliance issues' + steps: + - template: azure-pipelines/templates/scancode-template.yml@scancode-action + parameters: + pipelines: 'scan_codebase' + checkCompliance: true + complianceFailLevel: 'WARNING' \ No newline at end of file diff --git a/azure-pipelines/scancode-template.yml b/azure-pipelines/scancode-template.yml new file mode 100644 index 0000000..0d56116 --- /dev/null +++ b/azure-pipelines/scancode-template.yml @@ -0,0 +1,161 @@ +parameters: + - name: pipelines + type: string + default: "scan_codebase" + displayName: "Pipeline names (comma-separated)" + + - name: outputFormats + type: string + default: "json xlsx spdx cyclonedx" + displayName: "Output formats" + + - name: inputsPath + type: string + default: "$(Build.SourcesDirectory)/scancode-inputs" + displayName: "Path for pipeline inputs" + + - name: inputUrls + type: string + default: "" + displayName: "URLs to download (space-separated)" + + - name: projectName + type: string + default: "scancode-devops" + displayName: "Project name" + + - name: outputsArchiveName + type: string + default: "scancode-outputs" + displayName: "Outputs archive name" + + - name: checkCompliance + type: boolean + default: false + displayName: "Check for compliance issues" + + - name: complianceFailLevel + type: string + default: "ERROR" + displayName: "Compliance failure level" + values: + - ERROR + - WARNING + - MISSING + + - name: complianceFailOnVulnerabilities + type: boolean + default: false + displayName: "Fail on vulnerabilities" + + - name: pythonVersion + type: string + default: "3.12" + displayName: "Python version" + + - name: scancodeioRepoBranch + type: string + default: "" + displayName: "ScanCode.io GitHub branch (optional)" + +steps: + - task: UsePythonVersion@0 + displayName: 'Set up Python' + inputs: + versionSpec: '${{ parameters.pythonVersion }}' + addToPath: true + + - script: | + echo "##vso[task.setvariable variable=SECRET_KEY]$(openssl rand -base64 32)" + echo "##vso[task.setvariable variable=SCANCODEIO_DB_NAME]scancodeio" + echo "##vso[task.setvariable variable=SCANCODEIO_DB_USER]scancodeio" + echo "##vso[task.setvariable variable=SCANCODEIO_DB_PASSWORD]scancodeio" + displayName: 'Set up environment variables' + + - script: | + sudo systemctl start postgresql.service + sudo -u postgres createuser --no-createrole --no-superuser --login --inherit --createdb $(SCANCODEIO_DB_USER) + sudo -u postgres psql -c "ALTER USER $(SCANCODEIO_DB_USER) WITH encrypted password '$(SCANCODEIO_DB_PASSWORD)'" + sudo -u postgres createdb --owner=scancodeio --encoding=UTF-8 $(SCANCODEIO_DB_NAME) + displayName: 'Start and setup PostgreSQL service' + + - script: | + if [ -z "${{ parameters.scancodeioRepoBranch }}" ]; then + echo "Installing the latest ScanCode.io release from PyPI" + pip install --upgrade scancodeio + else + echo "Installing ScanCode.io from the GitHub branch: ${{ parameters.scancodeioRepoBranch }}" + pip install git+https://github.com/aboutcode-org/scancode.io.git@${{ parameters.scancodeioRepoBranch }} + fi + displayName: 'Install ScanCode.io' + + - script: | + scanpipe migrate --verbosity 0 + displayName: 'Run database migrations' + + - script: | + IFS=',' read -ra PIPELINES <<< "${{ parameters.pipelines }}" + PIPELINE_CLI_ARGS="" + for pipeline in "${PIPELINES[@]}"; do + PIPELINE_CLI_ARGS+=" --pipeline $pipeline" + done + echo "##vso[task.setvariable variable=PIPELINE_CLI_ARGS]${PIPELINE_CLI_ARGS}" + displayName: 'Generate pipeline CLI arguments' + + - script: | + INPUT_URL_CLI_ARGS="" + for url in ${{ parameters.inputUrls }}; do + INPUT_URL_CLI_ARGS+=" --input-url $url" + done + echo "##vso[task.setvariable variable=INPUT_URL_CLI_ARGS]${INPUT_URL_CLI_ARGS}" + displayName: 'Generate input URL CLI arguments' + + - script: | + scanpipe create-project ${{ parameters.projectName }} \ + $(PIPELINE_CLI_ARGS) \ + $(INPUT_URL_CLI_ARGS) + displayName: 'Create ScanCode project' + + - script: | + project_status=$(scanpipe status --project ${{ parameters.projectName }}) + work_directory=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+') + echo "##vso[task.setvariable variable=PROJECT_WORK_DIRECTORY]$work_directory" + displayName: 'Set project work directory' + + - script: | + SOURCE_PATH="${{ parameters.inputsPath }}" + DESTINATION_PATH="$(PROJECT_WORK_DIRECTORY)/input/" + if [ -d "$SOURCE_PATH" ]; then + cp -r "$SOURCE_PATH"/* "$DESTINATION_PATH" + fi + displayName: 'Copy input files to project work directory' + + - script: | + scanpipe execute --project ${{ parameters.projectName }} --no-color + displayName: 'Run ScanCode pipelines' + + - script: | + scanpipe output \ + --project ${{ parameters.projectName }} \ + --format ${{ parameters.outputFormats }} + displayName: 'Generate outputs' + + - task: PublishPipelineArtifact@1 + displayName: 'Upload ScanCode outputs' + inputs: + targetPath: '$(PROJECT_WORK_DIRECTORY)/output/' + artifact: '${{ parameters.outputsArchiveName }}' + publishLocation: 'pipeline' + + - script: | + cmd="scanpipe check-compliance \ + --project ${{ parameters.projectName }} \ + --fail-level ${{ parameters.complianceFailLevel }}" + + if [[ "${{ parameters.complianceFailOnVulnerabilities }}" == "true" ]]; then + cmd="$cmd --fail-on-vulnerabilities" + fi + + eval "$cmd" + displayName: 'Check compliance' + condition: eq('${{ parameters.checkCompliance }}', 'true') \ No newline at end of file From d8058951b78665cbbe234676abc3a098508b846c Mon Sep 17 00:00:00 2001 From: NucleonGodX Date: Fri, 18 Jul 2025 09:14:10 +0530 Subject: [PATCH 2/3] add readme for azurepipelines Signed-off-by: NucleonGodX --- azure-pipelines/README.md | 222 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 222 insertions(+) create mode 100644 azure-pipelines/README.md diff --git a/azure-pipelines/README.md b/azure-pipelines/README.md new file mode 100644 index 0000000..0cca9c0 --- /dev/null +++ b/azure-pipelines/README.md @@ -0,0 +1,222 @@ +# ScanCode.io Azure Pipeline Template + +Run [ScanCode.io](https://github.com/aboutcode-org/scancode.io) pipelines from your Azure DevOps Pipelines. + +- [Usage](#usage) + - [Basic](#basic) + - [Parameters](#parameters) +- [Examples](#examples) + - [Scan repo codebase](#scan-repo-codebase) + - [Run a specific pipeline](#run-a-specific-pipeline) + - [Run multiple pipelines](#run-multiple-pipelines) + - [Choose the output formats](#choose-the-output-formats) + - [Provide download URLs inputs](#provide-download-urls-inputs) + - [Fetch pipelines inputs](#fetch-pipelines-inputs) + - [Check for compliance issues](#check-for-compliance-issues) + - [Define a custom project name](#define-a-custom-project-name) + - [Install ScanCode.io from a repository branch](#install-scancodeio-from-a-repository-branch) +- [Where does the scan results go?](#where-does-the-scan-results-go) + +## Usage + +### Basic + +```yaml +stages: + - stage: ScanCode + jobs: + - job: RunScanCode + steps: + - template: scancode-template.yml + parameters: + pipelines: "scan_codebase" + outputFormats: "json xlsx spdx cyclonedx" +``` + +### Parameters + +```yaml +- template: scancode-template.yml + parameters: + # Names of the pipelines (comma-separated) and in order. + # Default is 'scan_codebase' + pipelines: + + # The list of output formats to generate. + # Default is 'json xlsx spdx cyclonedx' + outputFormats: + + # Relative path within the $(Build.SourcesDirectory) for pipeline inputs. + # Default is '$(Build.SourcesDirectory)/scancode-inputs' + inputsPath: + + # Provide one or more URLs to download for the pipeline run execution + inputUrls: + + # Name of the project. + # Default is 'scancode-devops' + projectName: + + # Name of the outputs archive. + # Default is 'scancode-outputs' + outputsArchiveName: + + # Check for compliance issues in the project. + # Exits with a non-zero status if compliance issues are detected. + # Default is false + checkCompliance: + + # Failure level for compliance check. Options: ERROR, WARNING, MISSING. + # Default is 'ERROR' + complianceFailLevel: + + # Exit with a non-zero status if known vulnerabilities are detected in discovered + # packages and dependencies. + # Default is false + complianceFailOnVulnerabilities: + + # Python version that will be installed to run ScanCode.io + # Default is '3.12' + pythonVersion: + + # Install ScanCode.io from a specific GitHub branch (optional) + # Default is empty (uses latest PyPI release) + scancodeioRepoBranch: +``` + +## Examples + +### Scan repo codebase + +```yaml +stages: + - stage: ScanCode + jobs: + - job: RunScanCode + steps: + - template: scancode-template.yml +``` + +### Run a specific pipeline + +[Built-in pipelines list](https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html) + +```yaml +- template: scancode-template.yml + parameters: + pipelines: "scan_codebase" +``` + +### Run multiple pipelines + +```yaml +- template: scancode-template.yml + parameters: + pipelines: "scan_codebase,find_vulnerabilities" + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ +``` + +#### Configuring find_vulnerabilities Pipeline + +The find_vulnerabilities pipeline requires access to a VulnerableCode instance, +which can be defined using the VULNERABLECODE_URL environment variable. + +In the example provided, a public instance is referenced. +However, you also have the option to run your own VulnerableCode instance. +For details on setting up and configuring your own instance, please refer to the +[VulnerableCode documentation](https://vulnerablecode.readthedocs.io/en/latest/index.html). + +#### Fail on known vulnerabilities + +When enabled, the pipeline will fail if any known vulnerabilities are found in the +project's discovered packages or dependencies. +Activate this behavior by enabling checkCompliance and setting +complianceFailOnVulnerabilities to true. + +```yaml +- template: scancode-template.yml + parameters: + pipelines: "scan_codebase,find_vulnerabilities" + checkCompliance: true + complianceFailOnVulnerabilities: true + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ +``` + +### Choose the output formats + +```yaml +- template: scancode-template.yml + parameters: + outputFormats: "json xlsx spdx cyclonedx" +``` + +> [!NOTE] +> To specify a CycloneDX spec version (default to latest), use the syntax + `cyclonedx:VERSION` as format value. For example: `cyclonedx:1.5`. + +### Provide download URLs inputs + +```yaml +- template: scancode-template.yml + parameters: + pipelines: "map_deploy_to_develop" + inputUrls: "https://domain.url/source.zip#from https://domain.url/binaries.zip#to" +``` + +### Fetch pipelines inputs + +```yaml +stages: + - stage: ScanCode + jobs: + - job: RunScanCode + steps: + - script: | + mkdir -p $(Build.SourcesDirectory)/scancode-inputs + wget --directory-prefix=$(Build.SourcesDirectory)/scancode-inputs https://github.com/$(Build.Repository.Name)/archive/$(Build.SourceBranch).zip + displayName: 'Download repository archive to scancode-inputs/ directory' + - template: scancode-template.yml + parameters: + pipelines: "scan_single_package" +``` + +### Check for compliance issues + +```yaml +- template: scancode-template.yml + parameters: + checkCompliance: true + complianceFailLevel: "WARNING" +``` + +> [!NOTE] +> This feature requires to provide Project policies. +> For details on setting up and configuring your own instance, please refer to the +> [ScanCode.io Policies documentation](https://scancodeio.readthedocs.io/en/latest/policies.html). + +### Define a custom project name + +```yaml +- template: scancode-template.yml + parameters: + projectName: "my-project-name" +``` + +### Install ScanCode.io from a repository branch + +```yaml +- template: scancode-template.yml + parameters: + scancodeioRepoBranch: "main" +``` + +## Where are the Scan Results? + +Upon completion of the pipeline, you can **find the scan results** in the dedicated +**pipeline artifacts section**. Navigate to your pipeline run summary page and look +for the **Artifacts** tab. The scan results will be available as a published artifact +named `scancode-outputs` (or your custom `outputsArchiveName` if specified). +This artifact contains all the outputs generated by the ScanCode.io pipelines in the +formats you specified. \ No newline at end of file From 43dc2d0e233ffe5b343b5ed722b4818521bf0dbd Mon Sep 17 00:00:00 2001 From: NucleonGodX Date: Fri, 18 Jul 2025 09:20:00 +0530 Subject: [PATCH 3/3] update template location Signed-off-by: NucleonGodX --- azure-pipelines/README.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/azure-pipelines/README.md b/azure-pipelines/README.md index 0cca9c0..d865a49 100644 --- a/azure-pipelines/README.md +++ b/azure-pipelines/README.md @@ -27,7 +27,7 @@ stages: jobs: - job: RunScanCode steps: - - template: scancode-template.yml + - template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: pipelines: "scan_codebase" outputFormats: "json xlsx spdx cyclonedx" @@ -36,7 +36,7 @@ stages: ### Parameters ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: # Names of the pipelines (comma-separated) and in order. # Default is 'scan_codebase' @@ -94,7 +94,7 @@ stages: jobs: - job: RunScanCode steps: - - template: scancode-template.yml + - template: azure-pipelines/templates/scancode-template.yml@scancode-action ``` ### Run a specific pipeline @@ -102,7 +102,7 @@ stages: [Built-in pipelines list](https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html) ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: pipelines: "scan_codebase" ``` @@ -110,7 +110,7 @@ stages: ### Run multiple pipelines ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: pipelines: "scan_codebase,find_vulnerabilities" env: @@ -135,7 +135,7 @@ Activate this behavior by enabling checkCompliance and setting complianceFailOnVulnerabilities to true. ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: pipelines: "scan_codebase,find_vulnerabilities" checkCompliance: true @@ -147,7 +147,7 @@ complianceFailOnVulnerabilities to true. ### Choose the output formats ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: outputFormats: "json xlsx spdx cyclonedx" ``` @@ -159,7 +159,7 @@ complianceFailOnVulnerabilities to true. ### Provide download URLs inputs ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: pipelines: "map_deploy_to_develop" inputUrls: "https://domain.url/source.zip#from https://domain.url/binaries.zip#to" @@ -177,7 +177,7 @@ stages: mkdir -p $(Build.SourcesDirectory)/scancode-inputs wget --directory-prefix=$(Build.SourcesDirectory)/scancode-inputs https://github.com/$(Build.Repository.Name)/archive/$(Build.SourceBranch).zip displayName: 'Download repository archive to scancode-inputs/ directory' - - template: scancode-template.yml + - template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: pipelines: "scan_single_package" ``` @@ -185,7 +185,7 @@ stages: ### Check for compliance issues ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: checkCompliance: true complianceFailLevel: "WARNING" @@ -199,7 +199,7 @@ stages: ### Define a custom project name ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: projectName: "my-project-name" ``` @@ -207,7 +207,7 @@ stages: ### Install ScanCode.io from a repository branch ```yaml -- template: scancode-template.yml +- template: azure-pipelines/templates/scancode-template.yml@scancode-action parameters: scancodeioRepoBranch: "main" ```