SBOM-Diff-Action

Create SBOM diffs from PR changes.

Usage

on:
  pull_request:
    types:
      - opened
      - edited
      - reopened
      - synchronize

jobs:
  sbom-diff:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: "0"
      - name: Create SBOM-Diff
        uses: ckotzbauer/sbom-diff-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SCAN_TARGET: file:go.mod

Environment Variables

Name	Description	Required
GITHUB_TOKEN	GITHUB_TOKEN or a repo scoped PAT.	true
SCAN_TARGET	Target to create SBOM from with Syft	true

Every documented source from Syft is allowed as SCAN_TARGET. The detected differences are added as PR comment.

License

MIT

Contributing

Please refer to the Contribution guildelines.

Code of conduct

Please refer to the Conduct guildelines.

Security

Please refer to the Security process.