Skip to content

Commit 048ca42

Browse files
KLongmuirHDKLongmuirHD
committed
chore: add demo docker scan workflows
1 parent 7aeb1a9 commit 048ca42

7 files changed

Lines changed: 268 additions & 4 deletions

‎.github/workflows/demo-build-and-scan-docker-image.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: (DEMO) HeroDevs CLI Build and Scan Docker Image
2+
3+
on:
4+
workflow_dispatch: {}
5+
6+
env:
7+
TRACKING_OPT_OUT: 'true'
8+
9+
jobs:
10+
build-and-sbom:
11+
name: Build and Generate SBOM
12+
environment: demo
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repo
16+
uses: actions/checkout@v4
17+
with:
18+
ref: main
19+
20+
- name: Set up Node.js
21+
uses: actions/setup-node@v4
22+
with:
23+
node-version: '22'
24+
25+
- name: Install cdxgen
26+
run: npm install -g @cyclonedx/cdxgen
27+
28+
- name: Build Docker image
29+
run: |
30+
docker build -f ./ci/image.Dockerfile -t herodevs/eol-scan:local .
31+
32+
- name: Generate SBOM for local Docker image
33+
run: |
34+
cdxgen -t docker -o sbom.json -r herodevs/eol-scan:local
35+
36+
- name: Upload SBOM artifact
37+
uses: actions/upload-artifact@v4
38+
with:
39+
name: cdxgen-sbom-json
40+
path: sbom.json
41+
42+
scan-sbom:
43+
name: Run HD Scan
44+
runs-on: ubuntu-latest
45+
needs: build-and-sbom
46+
steps:
47+
- name: Set up Node.js
48+
uses: actions/setup-node@v4
49+
with:
50+
node-version: '22'
51+
52+
- name: Download SBOM artifact
53+
uses: actions/download-artifact@v4
54+
with:
55+
name: cdxgen-sbom-json
56+
path: .
57+
58+
- name: Run EOL scan
59+
run: |
60+
npx @herodevs/cli@beta scan eol --file=sbom.json
61+
62+
- name: Upload HD report
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: herodevs-report
66+
path: herodevs.report.json

‎.github/workflows/demo-docker-buildx-sbom-scan.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: (DEMO) HeroDevs CLI Docker Buildx SBOM Scan
2+
3+
on:
4+
workflow_dispatch: {}
5+
6+
env:
7+
TRACKING_OPT_OUT: 'true'
8+
9+
jobs:
10+
build-and-sbom:
11+
name: Build Docker image & Generate SBOM
12+
environment: demo
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repo
16+
uses: actions/checkout@v4
17+
18+
- name: Set up Node.js
19+
uses: actions/setup-node@v4
20+
with:
21+
node-version: '22'
22+
23+
- name: Set up Docker Buildx
24+
uses: docker/setup-buildx-action@v3
25+
26+
- name: Enable BuildKit experimental features
27+
run: |
28+
export DOCKER_CLI_EXPERIMENTAL=enabled
29+
30+
- name: Build Docker image and generate SBOM
31+
run: |
32+
docker buildx build \
33+
--file ./ci/image.Dockerfile \
34+
--tag herodevs/eol-scan:local \
35+
--sbom=type=cyclonedx,output=sbom.json \
36+
--load \
37+
.
38+
39+
- name: Upload SBOM artifact
40+
uses: actions/upload-artifact@v4
41+
with:
42+
name: docker-buildx-sbom-json
43+
path: sbom.json
44+
45+
scan-sbom:
46+
name: Run HD Scan
47+
runs-on: ubuntu-latest
48+
needs: generate-sbom
49+
steps:
50+
- name: Set up Node.js
51+
uses: actions/setup-node@v4
52+
with:
53+
node-version: '22'
54+
55+
- name: Download SBOM artifact
56+
uses: actions/download-artifact@v4
57+
with:
58+
name: docker-buildx-sbom-json
59+
path: .
60+
61+
- name: Run EOL scan
62+
run: |
63+
npx @herodevs/cli@beta scan eol --file=sbom.json
64+
65+
- name: Upload HD report
66+
uses: actions/upload-artifact@v4
67+
with:
68+
name: herodevs-report
69+
path: herodevs.report.json

‎.github/workflows/demo-scan-docker-image.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: (DEMO) HeroDevs CLI Scan Docker Image
2+
3+
on:
4+
workflow_dispatch: {}
5+
6+
permissions:
7+
packages: read
8+
9+
env:
10+
TRACKING_OPT_OUT: 'true'
11+
12+
jobs:
13+
generate-sbom:
14+
name: Generate SBOM
15+
environment: demo
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout repo
19+
uses: actions/checkout@v4
20+
with:
21+
ref: main
22+
23+
- name: Set up Node.js
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: '22'
27+
28+
- name: Install cdxgen
29+
run: npm install -g @cyclonedx/cdxgen
30+
31+
- name: Pull Docker image
32+
run: docker pull ghcr.io/herodevs/eol-scan:latest
33+
34+
- name: Generate SBOM for Docker image
35+
run: |
36+
cdxgen -t docker -o sbom.json -r ghcr.io/herodevs/eol-scan:latest
37+
38+
- name: Upload SBOM artifact
39+
uses: actions/upload-artifact@v4
40+
with:
41+
name: cdxgen-sbom-json
42+
path: sbom.json
43+
44+
scan-sbom:
45+
name: Run HD Scan
46+
runs-on: ubuntu-latest
47+
needs: generate-sbom
48+
steps:
49+
- name: Set up Node.js
50+
uses: actions/setup-node@v4
51+
with:
52+
node-version: '22'
53+
54+
- name: Download SBOM artifact
55+
uses: actions/download-artifact@v4
56+
with:
57+
name: cdxgen-sbom-json
58+
path: .
59+
60+
- name: Run EOL scan
61+
run: |
62+
npx @herodevs/cli@beta scan eol --file=sbom.json
63+
64+
- name: Upload HD report
65+
uses: actions/upload-artifact@v4
66+
with:
67+
name: herodevs-report
68+
path: herodevs.report.json

‎.github/workflows/demo-scan-with-image.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: (DEMO) HeroDevs EOL Scan With Docker Image
2+
3+
on:
4+
workflow_dispatch: {}
5+
6+
env:
7+
TRACKING_OPT_OUT: 'true'
8+
9+
jobs:
10+
scan:
11+
runs-on: ubuntu-latest
12+
environment: demo
13+
steps:
14+
- uses: actions/checkout@v4
15+
with:
16+
ref: main
17+
18+
- name: Run EOL Scan with Docker
19+
uses: docker://ghcr.io/herodevs/eol-scan
20+
with:
21+
args: "-s"
22+
23+
- name: Upload artifact
24+
uses: actions/upload-artifact@v4
25+
with:
26+
name: my-eol-report
27+
path: herodevs.report.json

‎.github/workflows/demo-scan.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: (DEMO) HeroDevs EOL Scan NPX
2+
3+
on:
4+
workflow_dispatch: {}
5+
6+
env:
7+
TRACKING_OPT_OUT: 'true'
8+
9+
jobs:
10+
scan:
11+
runs-on: ubuntu-latest
12+
environment: demo
13+
steps:
14+
- uses: actions/checkout@v4
15+
with:
16+
ref: main
17+
18+
- uses: actions/setup-node@v4
19+
with:
20+
node-version: '22'
21+
22+
- name: Run EOL Scan
23+
run: npx @herodevs/cli@beta
24+
25+
- name: Upload artifact
26+
uses: actions/upload-artifact@v4
27+
with:
28+
name: my-eol-report
29+
path: herodevs.report.json

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,8 @@ pnpm-lock.yaml
1111
**/packages/cli-*/bin/
1212
**/tsconfig.tsbuildinfo
1313
.envrc
14+
15+
# Various SBOM Output Files
16+
herodevs.report.json
17+
herodevs.sbom.json
18+
bom.json

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ jobs:
223223
with:
224224
args: "-s"
225225

226-
- name: Upload artifact
226+
- name: Upload artifact
227227
uses: actions/upload-artifact@v4
228228
with:
229229
name: my-eol-report
@@ -273,14 +273,14 @@ jobs:
273273
- uses: actions/checkout@v4
274274
- uses: actions/setup-node@v4
275275
with:
276-
node-version: '20'
276+
node-version: '22'
277277
278278
- run: echo # Prepare environment, install tooling, perform setup, etc.
279279
280280
- name: Run EOL Scan
281-
run: npx @herodevs/cli@beta
281+
run: npx @herodevs/cli@beta scan eol
282282
283-
- name: Upload artifact
283+
- name: Upload artifact
284284
uses: actions/upload-artifact@v4
285285
with:
286286
name: my-eol-report

0 commit comments

Comments
 (0)