Merge branch 'main' into feat/trivy-allow-failure

Author: hupling

action-templates/actions/action-maven-build/action.yml

@@ -14,6 +14,12 @@ outputs:
   artifact-name:
     description: "Name of the artifact upload"
     value: ${{steps.artifact-name.outputs.artifact-name}}
+  cyclone-artifact-id:
+    description: "ID of the sbom artifact"
+    value: ${{steps.upload-sbom-artifact.outputs.artifact-id}}
+  cyclone-path:
+    description: "path of the sbom"
+    value: ${{steps.artifact-name.outputs.cyclone-path}}
 
 runs:
   using: "composite"
@@ -36,7 +42,11 @@ runs:
       shell: bash
     - id: artifact-name
       name: Set output variable $GITHUB_OUTPUT
-      run: echo "artifact-name=${{hashFiles(format('./{0}/pom.xml', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+      env:
+        APP_PATH: ${{inputs.app-path}}
+      run: |
+        echo "artifact-name=${{hashFiles(format('./{0}/pom.xml', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+        echo "cyclone-path=$APP_PATH/target/classes/META-INF/sbom/application.cdx.json" >> "$GITHUB_OUTPUT"
       shell: bash
     - id: upload-artifact
       name: Upload artifact
@@ -45,3 +55,11 @@ runs:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/target"
         retention-days: 5
+    - id: upload-sbom-artifact
+      name: upload-sbom-artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{inputs.app-path}}
+        path: "${{inputs.app-path}}/target/classes/META-INF/sbom/application.cdx.json"
+        retention-days: 5
+        archive: false

action-templates/actions/action-npm-build/action.yml

@@ -26,7 +26,12 @@ outputs:
   artifact-name:
     description: "Name of the artifact upload"
     value: ${{steps.artifact-name.outputs.artifact-name}}
-
+  cyclone-artifact-id:
+    description: "ID of the sbom artifact"
+    value: ${{steps.upload-sbom-artifact.outputs.artifact-id}}
+  cyclone-path:
+    value: ${{steps.artifact-name.outputs.cyclone-path}}
+    description: "path of the sbom"
 runs:
   using: "composite"
   steps:
@@ -61,11 +66,22 @@ runs:
       shell: bash
     - id: artifact-name
       name: Sets output variable $GITHUB_OUTPUT
-      run: echo "artifact-name=${{hashFiles(format('./{0}/package.json', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+      env:
+        APP_PATH: ${{inputs.app-path}}
+      run: |
+        echo "artifact-name=${{hashFiles(format('./{0}/package.json', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+        echo "cyclone-path=$APP_PATH/dist/application.cdx.json" >> "$GITHUB_OUTPUT"
       shell: bash
     - name: Upload artifact
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/dist"
         retention-days: 5
+    - id: upload-sbom-artifact
+      name: upload-sbom-artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        path: "${{inputs.app-path}}/dist/application.cdx.json"
+        retention-days: 5
+        archive: false

action-templates/actions/action-trivy/action.yml

@@ -15,14 +15,19 @@ inputs:
     required: false
     default: "false"
   path:
-    description: "Path to scan with Trivy"
+    description: "Path to scan with Trivy. For scan-type=sbom, this must point to a specific SBOM file (e.g. sbom.cdx.json), not a directory."
     required: false
     default: "."
+  scan-type:
+    description: "scan type, e.g. fs or sbom"
+    required: false
+    default: "fs"
 
 runs:
   using: "composite"
   steps:
     - name: Checkout repository
+      if: inputs.scan-type  == 'fs'
       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         fetch-depth: 0 # Required for vitepress lastUpdated
@@ -32,8 +37,8 @@ runs:
       env:
         TRIVY_INCLUDE_DEV_DEPS: "true"
       with:
-        scan-type: "fs"
-        scan-ref: ${{ inputs.path }}
+        scan-type: "${{ inputs.scan-type }}"
+        scan-ref: "${{ inputs.path }}"
         format: "json"
         exit-code: ${{ inputs.allow-failure == 'true' && '0' || '1' }}
         timeout: "${{ inputs.timeout }}"

docs/actions.md

@@ -428,6 +428,8 @@ Executes the following steps:
 Output parameters:
 
 1. `artifact-name`: Name of the uploaded artifact
+2. `cyclone-artifact-id`: ID of the sbom artifact
+3. `cyclone-path`: path of the sbom
 
 Workflows using that action need the following permissions:
 
@@ -533,6 +535,8 @@ Executes the following steps:
 Output parameters:
 
 1. `artifact-name`: Name of the uploaded artifact
+2. `cyclone-artifact-id`: ID of the sbom artifact
+3. `cyclone-path`: path of the sbom
 
 Workflows using that action need the following permissions:
 
@@ -674,6 +678,9 @@ Workflows using that action need the following permissions:
     # If the action should succeed even if Trivy fails
     # Default: false
     allow-failure: "false"
+    # scan type, e.g. fs or sbom
+    # defualt: fs
+    scan-type: fs
     # Path to scan with Trivy
     # Default: .
     path: "."