diff --git a/.github/workflows/scan-codebase.yml b/.github/workflows/scan-codebase.yml new file mode 100644 index 0000000..929f1c9 --- /dev/null +++ b/.github/workflows/scan-codebase.yml @@ -0,0 +1,15 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-latest + name: Scan codebase with ScanCode.io + steps: + - uses: actions/checkout@v4 + with: + path: scancode-inputs + - uses: nexB/scancode-action@alpha + with: + pipelines: "scan_codebase,find_vulnerabilities" + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ diff --git a/.github/workflows/scan-package.yml b/.github/workflows/scan-package.yml new file mode 100644 index 0000000..314db73 --- /dev/null +++ b/.github/workflows/scan-package.yml @@ -0,0 +1,13 @@ +on: [push] + +jobs: + scan-codebase: + runs-on: ubuntu-latest + name: Scan package with ScanCode.io + steps: + - name: Download repository archive to scancode-inputs/ directory + run: | + wget --directory-prefix=scancode-inputs https://github.com/${GITHUB_REPOSITORY}/archive/${GITHUB_REF}.zip + - uses: nexB/scancode-action@alpha + with: + pipelines: "scan_package" diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..214c3bd --- /dev/null +++ b/.gitignore @@ -0,0 +1,98 @@ +# Ignore node_modules, ncc is used to compile nodejs modules into a single file in the releases branch +node_modules/ +__tests__/runner/* + +# Ignore js files that are transpiled from ts files in src/ +lib/ + +# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore +# Logs +logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* +lerna-debug.log* + +# Diagnostic reports (https://nodejs.org/api/report.html) +report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json + +# Runtime data +pids +*.pid +*.seed +*.pid.lock + +# Directory for instrumented libs generated by jscoverage/JSCover +lib-cov + +# Coverage directory used by tools like istanbul +coverage +*.lcov + +# nyc test coverage +.nyc_output + +# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files) +.grunt + +# Bower dependency directory (https://bower.io/) +bower_components + +# node-waf configuration +.lock-wscript + +# Compiled binary addons (https://nodejs.org/api/addons.html) +build/Release + +# Dependency directories +jspm_packages/ + +# TypeScript v1 declaration files +typings/ + +# TypeScript cache +*.tsbuildinfo + +# Optional npm cache directory +.npm + +# Optional eslint cache +.eslintcache + +# Optional REPL history +.node_repl_history + +# Output of 'npm pack' +*.tgz + +# Yarn Integrity file +.yarn-integrity + +# dotenv environment variables file +.env +.env.test + +# parcel-bundler cache (https://parceljs.org/) +.cache + +# next.js build output +.next + +# nuxt.js build output +.nuxt + +# vuepress build output +.vuepress/dist + +# Serverless directories +.serverless/ + +# FuseBox cache +.fusebox/ + +# DynamoDB Local files +.dynamodb/ + +# Editor +.idea diff --git a/README.md b/README.md index 7ac3662..a258a82 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,140 @@ -# scancode-action -Run ScanCode scan in your workflow +# `@nexB/scancode-action` + +Run [ScanCode.io](https://github.com/nexB/scancode.io) pipelines from your Workflows. + +> [!IMPORTANT] +> The scancode-action is currently in the **alpha stage**, and we invite you to +> contribute to its improvement. Please feel free to submit bug reports or share +> your ideas by creating new entries in the "Issues" section. +> Your collaboration helps us enhance the action and ensures a more stable and +> effective tool for the community. +> Thank you for your support! + +- [Usage](#usage) + - [Basic](#basic) + - [Inputs](#inputs) +- [Examples](#examples) + - [Scan repo codebase](#scan-repo-codebase) + - [Run a specific pipeline](#run-a-specific-pipeline) + - [Run multiple pipelines](#run-multiple-pipelines) + - [Choose the output formats](#choose-the-output-formats) + - [Fetch pipelines inputs](#fetch-pipelines-inputs) + - [Define a custom project name](#define-a-custom-project-name) +- [Where does the scan results go?](#where-does-the-scan-results-go) + +## Usage + +### Basic + +```yaml +steps: +- uses: actions/checkout@v4 + with: + path: scancode-inputs +- uses: nexB/scancode-action@alpha + with: + pipelines: "scan_codebase" + output-formats: "json xlsx spdx cyclonedx" +``` + +### Inputs + +```yaml +- uses: nexB/scancode-action@alpha + with: + # Names of the pipelines (comma-separated) and in order. + # Default is 'scan_codebase' + pipelines: + + # The list of output formats to generate. + # Default is 'json xlsx spdx cyclonedx' + output-formats: + + # Relative path within the $GITHUB_WORKSPACE for pipeline inputs. + # Default is 'scancode-inputs' + inputs-path: + + # Name of the project. + # Default is 'scancode-action' + project-name: + + # Python version that will be installed to run ScanCode.io + # Default is '3.11' + python-version: +``` + +## Examples + +### Scan repo codebase + +```yaml +steps: +- uses: actions/checkout@v4 + with: + path: scancode-inputs +- uses: nexB/scancode-action@alpha +``` + +### Run a specific pipeline + +[Built-in pipelines list](https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html) + +```yaml +- uses: nexB/scancode-action@alpha + with: + pipelines: "scan_codebase" +``` + +### Run multiple pipelines + +```yaml +- uses: nexB/scancode-action@alpha + with: + pipelines: "scan_codebase,find_vulnerabilities" + env: + VULNERABLECODE_URL: https://public.vulnerablecode.io/ +``` + +#### Configuring `find_vulnerabilities` Pipeline + +The `find_vulnerabilities` pipeline requires access to a VulnerableCode instance, +which can be defined using the `VULNERABLECODE_URL` environment variable. + +In the example provided, a public instance is referenced. +However, you also have the option to run your own VulnerableCode instance. +For details on setting up and configuring your own instance, please refer to the +[VulnerableCode documentation](https://vulnerablecode.readthedocs.io/en/latest/index.html). + +### Choose the output formats + +```yaml +- uses: nexB/scancode-action@alpha + with: + output-formats: "json xlsx spdx cyclonedx" +``` + +### Fetch pipelines inputs + +```yaml +- name: Download repository archive to scancode-inputs/ directory + run: | + wget --directory-prefix=scancode-inputs https://github.com/${GITHUB_REPOSITORY}/archive/${GITHUB_REF}.zip +- uses: nexB/scancode-action@alpha + with: + pipelines: "scan_single_package" +``` + +### Define a custom project name + +```yaml +- uses: nexB/scancode-action@alpha + with: + project-name: "my-project-name" +``` + +## Where are the Scan Results? + +Upon completion of the workflow, you can **find the scan results** in the dedicated +**artifacts section** at the bottom of the workflow summary page. +Look for a file named `scanpipe-outputs` in that section. +This file contains the outputs generated by the `scancode-action`. diff --git a/action.yml b/action.yml new file mode 100644 index 0000000..20b873c --- /dev/null +++ b/action.yml @@ -0,0 +1,83 @@ +name: "ScanCode action" +description: "Run ScanCode.io pipelines in your workflows" +inputs: + pipelines: + description: "Names of the pipelines (comma-separated) and in order." + default: "scan_codebase" + output-formats: + description: "Output formats" + default: "json xlsx spdx cyclonedx" + inputs-path: + description: "Relative path within the $GITHUB_WORKSPACE for pipeline inputs" + default: "${{ github.workspace }}/scancode-inputs" + project-name: + description: "Name of the project" + default: "scancode-action" + python-version: + description: "Python version" + default: "3.11" + +runs: + using: "composite" + steps: + - uses: actions/setup-python@v5 + with: + python-version: ${{ inputs.python-version }} + + - name: Set up environment + shell: bash + run: | + echo "SECRET_KEY=$(openssl rand -base64 32)" >> $GITHUB_ENV + echo "SCANCODEIO_DB_ENGINE=django.db.backends.sqlite3" >> $GITHUB_ENV + echo "SCANCODEIO_DB_NAME=sqlite3.db" >> $GITHUB_ENV + + - name: Install ScanCode.io + shell: bash + run: | + pip install scancodeio + scanpipe migrate + + - name: Generate pipelines CLI arguments + shell: bash + run: | + IFS=',' read -ra PIPELINES <<< "${{ inputs.pipelines }}" + options="" + for pipeline in "${PIPELINES[@]}"; do + options+="--pipeline $pipeline " + done + echo "PIPELINE_CLI_ARGS=${options}" >> $GITHUB_ENV + + - name: Create project with ${{ inputs.pipelines }} pipelines + shell: bash + run: | + scanpipe create-project ${{ inputs.project-name }} ${{ env.PIPELINE_CLI_ARGS }} + + - name: Set project work directory in the environment + shell: bash + run: | + project_status=$(scanpipe status --project ${{ inputs.project-name }}) + work_directory=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+') + echo "PROJECT_WORK_DIRECTORY=$work_directory" >> $GITHUB_ENV + + - name: Copy input files to project work directory + shell: bash + run: cp -r ${{ inputs.inputs-path }}/* ${{ env.PROJECT_WORK_DIRECTORY }}/input/ + + - name: Run the pipelines + shell: bash + run: scanpipe execute --project ${{ inputs.project-name }} --no-color + + - name: Generate outputs + id: scanpipe + shell: bash + run: scanpipe output + --project ${{ inputs.project-name }} + --format ${{ inputs.output-formats }} + --no-color + + - name: Upload outputs + uses: actions/upload-artifact@v4 + id: artifact-upload-step + with: + name: scanpipe-outputs + path: ${{ env.PROJECT_WORK_DIRECTORY }}/output/*