Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity

feat: add dual-side diagnostic overview and fail-safe gating #10

Merged
Philipp merged 4 commits from feat-diagnostic-overview-and-gating into main 2026-09-13 20:52:55 +02:00
Conversation 3 Commits 4 Files Changed 3
+25 -15
1 changed files with 25 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 86a00c54dc - Show all commits
action.yaml
+25 -15
View File
@@ -24,6 +24,10 @@ inputs:
description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
required: false
default: 'true'
use-inbuild-sbom:
description: Whether to inspect and use built-in image SBOM attestations. If false, generates SBOM directly from images with Trivy.
required: false
default: 'false'
outputs:
delta-report:
@@ -58,14 +62,15 @@ runs:
- name: Install and Verify Trivy
shell: bash
run: |
mkdir -p "$HOME/.cache/trivy-bin" "$HOME/.local/bin"
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
set -euo pipefail
ARCH=$(uname -m)
case "$ARCH" in
mkdir -p "$HOME/.local/bin" "$HOME/.cache/trivy-bin"
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
ARCH="$(uname -m)"
case "${ARCH}" in
x86_64) T_ARCH="64bit" ;;
aarch64|arm64) T_ARCH="ARM64" ;;
*) echo "Unsupported architecture: $ARCH"; exit 1 ;;
*) echo "::error::Unsupported architecture: ${ARCH}"; exit 1 ;;
esac
checksums_file="${{ github.action_path }}/checksums.txt"
@@ -100,9 +105,11 @@ runs:
head_sbom_err=""
target_sbom_err=""
use_inbuild="${{ inputs.use-inbuild-sbom }}"
# --- Head Image SBOM Extraction ---
echo "Extracting platform SBOMs for head image: ${{ inputs.head-image }}..."
if [ "$use_inbuild" = "true" ]; then
echo "Attempting extraction of built-in SBOM attestations for head image: ${{ inputs.head-image }}..."
docker buildx imagetools inspect "${{ inputs.head-image }}" \
--format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sboms/head/sbom-amd64.spdx.json 2>/dev/null || true
cleanup_file sboms/head/sbom-amd64.spdx.json
@@ -117,22 +124,24 @@ runs:
--format '{{ json .SBOM.SPDX }}' > sboms/head/sbom-amd64.spdx.json 2>/dev/null || true
cleanup_file sboms/head/sbom-amd64.spdx.json
fi
fi
# Fallback to generating head SBOM with Trivy if attestation missing
# Generate head SBOM with Trivy if attestation not used or missing
if [ ! -f sboms/head/sbom-amd64.spdx.json ] && [ ! -f sboms/head/sbom-arm64.spdx.json ]; then
echo "Head image lacks SBOM attestation; generating with Trivy..."
echo "Generating SBOM for head image directly with Trivy: ${{ inputs.head-image }}..."
if ! trivy image --skip-version-check --format spdx-json --output sboms/head/sbom-amd64.spdx.json "${{ inputs.head-image }}"; then
head_sbom_err="Failed to generate fallback SBOM with Trivy for head image"
head_sbom_err="Failed to generate SBOM with Trivy for head image"
fi
cleanup_file sboms/head/sbom-amd64.spdx.json
fi
if [ ! -f sboms/head/sbom-amd64.spdx.json ] && [ ! -f sboms/head/sbom-arm64.spdx.json ] && [ -z "$head_sbom_err" ]; then
head_sbom_err="No SBOM attestation found and head image could not be inspected"
head_sbom_err="No SBOM generated and head image could not be inspected"
fi
# --- Target Image SBOM Extraction ---
echo "Extracting platform SBOMs for target image: ${{ inputs.target-image }}..."
if [ "$use_inbuild" = "true" ]; then
echo "Attempting extraction of built-in SBOM attestations for target image: ${{ inputs.target-image }}..."
docker buildx imagetools inspect "${{ inputs.target-image }}" \
--format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sboms/target/sbom-amd64.spdx.json 2>/dev/null || true
cleanup_file sboms/target/sbom-amd64.spdx.json
@@ -146,18 +155,19 @@ runs:
--format '{{ json .SBOM.SPDX }}' > sboms/target/sbom-amd64.spdx.json 2>/dev/null || true
cleanup_file sboms/target/sbom-amd64.spdx.json
fi
fi
# Fallback to generating target SBOM with Trivy if attestation missing
# Generate target SBOM with Trivy if attestation not used or missing
if [ ! -f sboms/target/sbom-amd64.spdx.json ] && [ ! -f sboms/target/sbom-arm64.spdx.json ]; then
echo "Target image lacks SBOM attestation; attempting to generate with Trivy..."
echo "Generating SBOM for target image directly with Trivy: ${{ inputs.target-image }}..."
if ! trivy image --skip-version-check --format spdx-json --output sboms/target/sbom-amd64.spdx.json "${{ inputs.target-image }}"; then
target_sbom_err="Failed to generate fallback SBOM with Trivy for target image"
target_sbom_err="Failed to generate SBOM with Trivy for target image"
fi
cleanup_file sboms/target/sbom-amd64.spdx.json
fi
if [ ! -f sboms/target/sbom-amd64.spdx.json ] && [ ! -f sboms/target/sbom-arm64.spdx.json ] && [ -z "$target_sbom_err" ]; then
target_sbom_err="No SBOM attestation found and target baseline image could not be inspected"
target_sbom_err="No SBOM generated and target baseline image could not be inspected"
fi
# Report on both sides