Skip to content

Add a basic SBOM workflow (closes #1838) #1854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
o1oo11oo merged 15 commits into from
Oct 5, 2023
Merged

Add a basic SBOM workflow (closes #1838) #1854

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
2ad6589
#1838 Use trivy to generate CycloneDX SBOMs
Aug 8, 2023
643937f
#1838 Add a parser for CycloneDX SBOMs
Aug 8, 2023
1af7a18
#1838 Add a Dependency-Track persistence hook
Aug 9, 2023
812303e
#1838 Clarify CycloneDX parser Makefile changes
Sep 1, 2023
55a4a7c
#1838 Add unit tests for dependencytrack hook
Sep 4, 2023
332a175
#1838 Add unit tests for parser-cyclonedx
Sep 4, 2023
3c8aab6
#1838 Move trivy-sbom to its own scanner
Sep 8, 2023
fc8b413
#1838 Add CycloneDX test file to sbom parser tests
Sep 11, 2023
c9f34df
#1838 Add integration tests for trivy-sbom scanner
Sep 11, 2023
282a671
#1838 Add SBOM components to GitHub workflows
Sep 11, 2023
7a1453d
#1838 Exclude more files from helm chart
Sep 11, 2023
337bdce
#1838 Cross-reference SBOM workflow components
Sep 15, 2023
dccdeac
#1838 Check Dependency-Track response for errors
Sep 15, 2023
67c3f4f
#1838 Fix image name and version recognition
Sep 12, 2023
06f6874
#1838 Add trivy-sbom-image to telemetry service
Sep 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
#1838 Add SBOM components to GitHub workflows 
Releases and CI only partially use makefiles. To make sure the
trivy-sbom scanner and the persistence-dependencytrack hook are included
in all builds, they are added to the corresponding matrix lists here.

Signed-off-by: Lukas Fischer <lukas.fischer@iteratec.com>
  • Loading branch information
Lukas Fischer
Lukas Fischer committed Sep 18, 2023
commit 282a6718dfa54ab514ac3b6c81f42ce4f58896df
2 changes: 2 additions & 0 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,6 +350,7 @@ jobs:
- ssh-scan
- sslyze
- trivy
- trivy-sbom
- typo3scan
- whatweb
- wpscan
Expand Down Expand Up @@ -703,6 +704,7 @@ jobs:
- generic-webhook
- persistence-azure-monitor
# - persistence-elastic # Fails on the CI due to insufficient cpu as mentioned in issue #1165
- persistence-dependencytrack
- update-field-hook
- finding-post-processing
- notification
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/release-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,7 @@ jobs:
- notification
- persistence-elastic
- persistence-defectdojo
- persistence-dependencytrack
- persistence-azure-monitor
- update-field-hook
steps:
Expand Down Expand Up @@ -340,6 +341,7 @@ jobs:
- sslyze
- test-scan
- trivy
- trivy-sbom
- typo3scan
- whatweb
- wpscan
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/scb-bot.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ jobs:
- ssh-scan
- sslyze
- trivy
- trivy-sbom
- typo3scan
- whatweb
- wpscan
Expand Down