sbom.yml

# This workflow is designed to download the Software Bill of Materials (SBOM) from two sources
# - Export SBOM using GitHub's Dependency Graph API as CSV and JSON
# - Import into Blackduck SCM (new legal tool)
#
# two other runs are supported minimally:
# - generate SBOM using Microsoft SBOM Tool
# - generate SBOM using Chef license scout Tool
#
# sbom.yml
name: Download SBOM from Insights and Convert to CSV
# logic for GH SBOM borrowed from Sonu's https://progresssoftware.atlassian.net/browse/CHEF-17029 and specific file
# https://github.com/inspec/inspec-rabbitmq-resources/blob/3504270b55efb606ac97497b2f2ee33edb23911e/.github/workflows/sbom-gh-insights.yml

# other SBOM tools include:
# CycloneDX, then sbomqualityscore (https://github.com/interlynk-io/sbomqs) - https://github.com/marketplace/actions/cyclonedx-gomod-generate-sbom
  # CLI combines SBOMs https://github.com/CycloneDX/cyclonedx-cli , docs at https://cyclonedx.org/capabilities/sbom/
  # https://github.com/ozonru/cyclonedx-go
# MSFT SBOM, then sbomqualityscore (https://github.com/interlynk-io/sbomqs) - https://github.com/microsoft/sbom-tool/blob/main/docs/setting-up-github-actions.md 
# Grype - https://github.com/marketplace/actions/anchore-container-scan, https://github.com/anchore/grype
# open Spdx-sbom-generator - https://github.com/opensbom-generator/spdx-sbom-generator 
# https://github.com/srcclr/srcclr_sbom_gen 
# https://github.com/openclarity/kubeclarity?tab=readme-ov-file#installation 

# BLACKDUCK SBOM
# required secrets: BLACKDUCK_SCA_URL, BLACKDUCK_SCA_TOKEN (organization)
# required inputs: blackduck-project-group-name, blackduck-project-name, version


on:
  workflow_call:
    inputs:
      version:
        description: 'Version of the project'
        required: true
        type: string
      export-github-sbom:
        description: 'Export SBOM from GitHub Dependency Graph API' 
        required: false
        type: boolean
      perform-blackduck-sca-scan: # combined with export-github-sbom above
        description: 'Perform BlackDuck SCA scan'
        required: false
        type: boolean
        default: true
      # generate-blackduck-sbom:  # obsolete
      #   description: 'Generate SBOM using Blackduck Tool'
      #   required: false
      #   type: boolean
      blackduck-project-group-name:
        description: 'BlackDuck project group name'
        required: false
        type: string
      blackduck-project-name:
        description: 'BlackDuck project name'
        required: false
        type: string
      generate-msft-sbom:
        description: 'Generate SBOM using Microsoft SBOM Tool'
        required: false
        type: boolean
      license_scout:
        description: 'Generate SBOM using Chef license scout Tool'
        required: false
        type: boolean
      go-private-modules:
        required: false
        type: string
      run-bundle-install:
        description: 'Run bundle install before scanning to generate Gemfile.lock at runtime'
        required: false
        type: boolean
        default: false

env:
  # Set the default SBOM filename prefix
  FILE_PREFIX: $(echo "${{ github.repository }}" | sed 's|/|-|g')-$(date +%Y%m%d%H%M%S)
  DEFAULT_FILE_NAME: "GitHub-sbom"
  DEFAULT_FILE_EXTENSION: ".json"
  DEFAULT_SEPARATOR: "-"

jobs:
  export-github-SBOM:
    name: Export SBOM from GitHub Dependency Graph API
    runs-on: ubuntu-latest
    if : ${{ inputs.export-github-sbom == true }}
    steps:
    - name: Checkout Code
      uses: actions/checkout@v6

    - name: Generate Filename Prefix and full JSON file name as environment variables for later steps
      run: |
        FILE_PREFIX=$(echo "${{ github.repository }}${{ env.DEFAULT_SEPARATOR }}${{ github.ref_name }}${{ env.DEFAULT_SEPARATOR }}${{ inputs.version }}" | sed 's|/|-|g')-$(date +%Y%m%d%H%M%S)
        echo "FILE_PREFIX=${FILE_PREFIX}" >> $GITHUB_ENV
        FILE_NAME=$(echo "${{ env.FILE_PREFIX }}${{ env.DEFAULT_SEPARATOR }}${{ env.DEFAULT_FILE_NAME }}${{ env.DEFAULT_FILE_EXTENSION }}")
        echo "FILE_NAME=${FILE_NAME}" >> $GITHUB_ENV
      
    - name: Download SBOM from GitHub Dependency Graph API
      run: |
        curl -L \
          -H "Accept: application/vnd.github+json" \
          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
          -H "X-GitHub-Api-Version: 2022-11-28" \
          https://api.github.com/repos/${{ github.repository }}/dependency-graph/sbom \
          -o "${{ env.FILE_NAME }}"
      continue-on-error: true

    - name: Upload JSON artifact
      uses: actions/upload-artifact@v4
      with:
        # name: ${{ env.FILE_PREFIX }}-GitHub-SBOM.json
        name: ${{ env.FILE_NAME }}
        # path: ${{ env.FILE_PREFIX }}-GitHub-SBOM.json
        path: ${{ env.FILE_NAME }}
      continue-on-error: true

    - name: Convert SBOM to CSV using jq
      run: |
        echo "name,SPDXID,versionInfo,downloadLocation,externalRefs,license,source_code_url,vendor" > "${FILE_PREFIX}${DEFAULT_SEPARATOR}${DEFAULT_FILE_NAME}.csv"
        jq -r '
          .sbom.packages[] | [
            .name,
            .SPDXID,
            .versionInfo,
            .downloadLocation,
            ( .externalRefs[]? | .referenceLocator ),
            "None", "None", "None"
          ] | @csv' "${FILE_NAME}" >> "${FILE_PREFIX}${DEFAULT_SEPARATOR}${DEFAULT_FILE_NAME}.csv"
      continue-on-error: true
    
    # TODO: add enrichment from other sources (pkgdev (Go), cargo, GitHub Actions / Marketplace etc.)
    - name: Enrich SBOM CSV from RubyGems
      run: |
        TEMP_CSV="${FILE_PREFIX}${DEFAULT_SEPARATOR}${DEFAULT_FILE_NAME}-temp.csv"
        echo "name,SPDXID,versionInfo,downloadLocation,externalRefs,license,source_code_url,vendor" > "$TEMP_CSV"
        tail -n +2 "${FILE_PREFIX}${DEFAULT_SEPARATOR}${DEFAULT_FILE_NAME}.csv" | while IFS=, read -r name SPDXID versionInfo downloadLocation externalRefs license source_code_url vendor; do
          # Debug each row
          echo "Processing: $name, $SPDXID, $versionInfo, $downloadLocation, $externalRefs, $license, $source_code_url, $vendor"
          if [[ "$externalRefs" == *"pkg:gem"* ]]; then
            echo "Processing RubyGem: $name"
            gem_name=$(echo "$name" | tr -d '"')
            version=$(echo "$versionInfo" | tr -d '"')
            # Check if the version contains a version constraint (e.g., ~>, >=, <=)
            if [[ "$versionInfo" =~ [\~\>\<\=\ ] ]]; then
              echo "Skipping call to rubygems.org for version constraint: $versionInfo"
            else
              # Proceed with making the call to rubygems.org
              echo "Making call to rubygems.org for fixed version: $versionInfo"
              # Your logic to call rubygems.org
              api_url="https://rubygems.org/api/v2/rubygems/${gem_name}/versions/${version}.json"
              response=$(curl -s "$api_url")
              echo "Response: $response"
              new_license=$(echo "$response" | jq -r '.licenses[0] // "None"')
              echo "License: $new_license"
              new_source_code_url=$(echo "$response" | jq -r '.source_code_uri // "None"')
              new_vendor=$(echo "$response" | jq -r '.authors // "None"')
            fi
          else
            new_license="None"
            new_source_code_url="None"
            new_vendor="None"
          fi
          echo "$name,$SPDXID,$versionInfo,$downloadLocation,$externalRefs,$new_license,$new_source_code_url,$new_vendor" >> "$TEMP_CSV"
        done
        mv "$TEMP_CSV" "${FILE_PREFIX}${DEFAULT_SEPARATOR}${DEFAULT_FILE_NAME}.csv"
      continue-on-error: true
    
    - name: Upload SBOM CSV as Artifact
      uses: actions/upload-artifact@v4
      with:
        # name: ${{ env.FILE_PREFIX }}-GitHub-SBOM.csv
        name: ${{ env.FILE_PREFIX }}${{ env.DEFAULT_SEPARATOR }}${{ env.DEFAULT_FILE_NAME }}.csv
        # path: ${{ env.FILE_PREFIX }}-GitHub-SBOM.csv
        path: ${{ env.FILE_PREFIX }}${{ env.DEFAULT_SEPARATOR }}${{ env.DEFAULT_FILE_NAME }}.csv

# example project https://progresssoftware.app.blackduck.com/api/risk-profile-dashboard?limit=25&offset=0
# server URL https://progresssoftware.app.blackduck.com/api/projects/c7954ee4-348d-4c2f-b259-d577e1df40dc
# and https://progresssoftware.app.blackduck.com/api/risk-profile-dashboard?limit=25&offset=0
#
# Blackduck SBOM is at SERVER: https://progresssoftware.app.blackduck.com/ - org variable!
# API token in repo - https://github.com/chef/chef-vault/settings/secrets/actions
  generate-blackduck-sbom:
    name: Generate SBOM using Blackduck Tool (BLUE)
    runs-on: ubuntu-latest
    if: ${{ inputs.perform-blackduck-sca-scan == true || inputs.generate-blackduck-polaris-sbom == true }} # generate-blackduck--polaris-sbom is OBSOLETE, use perform-blackduck-sca-scan instead
    steps:
      - name: 'Echo inputs'
        run: |
          echo "Starting BlackDuck SCA scan"
          echo "BlackDuck_SCA_URL: ${{ secrets.BLACKDUCK_SBOM_URL }}"
          echo "BLACKDUCK_SCA_TOKEN: ${{ secrets.BLACKDUCK_SCA_TOKEN }}"
          echo "DETECT_PROJECT_GROUP_NAME: ${{ inputs.blackduck-project-group-name }}"
          echo "DETECT_PROJECT_NAME: ${{ inputs.blackduck-project-name }}"
          echo "DETECT_PROJECT_VERSION_NAME: ${{ inputs.version }}"
         
      - name: Checkout source
        uses: actions/checkout@v6

      - name: Set up Ruby and run bundle install
        if: ${{ inputs.run-bundle-install == true }}
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.4'
          bundler-cache: true

      - name: Configure git for private Go modules
        env:
          GOPRIVATE: ${{ inputs.go-private-modules }}
        run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"

      - name: BlackDuck SCA scan
        id: black-duck-sca-scan
        run: |
          echo "BLACKDUCK_SBOM_URL: ${{ secrets.BLACKDUCK_SBOM_URL }}"
        # echo "BLACKDUCK_SBOM_API_KEY: ${{ secrets.BLACKDUCK_SBOM_API_KEY }}" no longer used, see BLACKDUCK_SCA_TOKEN

      - name: BlackDuck SBOM scan
        uses: blackduck-inc/black-duck-security-scan@v2.1.1
        continue-on-error: true  # Allow pipeline to continue even with policy violations
        env: 
          GOPRIVATE: ${{ inputs.go-private-modules }}
          DETECT_PROJECT_GROUP_NAME: ${{ inputs.blackduck-project-group-name}} #'Chef-Agents' # <the_parent_group_of_your_target_project>, Chef, Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services
          DETECT_PROJECT_NAME: ${{ inputs.blackduck-project-name }}
          DETECT_PROJECT_VERSION_NAME: ${{ inputs.version }} # <the_existing_version_in_your_project>
        with:
          blackducksca_url: ${{ secrets.BLACKDUCK_SBOM_URL }}  # BLACKDUCK_URL, should be https://progresssoftware.app.blackduck.com/ 
          blackducksca_token: ${{ secrets.BLACKDUCK_SCA_TOKEN }}  # was BLACKDUCK_API_KEY
          # blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL'
          detect_args: --detect.excluded.detector.types=PIP   # ignore python per https://documentation.blackduck.com/bundle/detect/page/packagemgrs/python.html

######################################################
# original from https://github.com/progress-platform-services/common-github-actions/blob/main/.github/workflows/examples/ci-all-sbom-main.yml

  generate-msft-sbom:
    name: Generate MSFT SBOM
    runs-on: ubuntu-latest
    if: ${{ inputs.generate-msft-sbom == true }}
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v6
# TODO: cache the sbom-tool binary
    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: 'stable'
#        go-version: 1.24.2
#        check-latest: true
    - name: Configure git for private modules
      env:
        GOPRIVATE: ${{ inputs.go-private-modules }}
      run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"

    - name: create folder
      run: mkdir -p ./bin
    
    - name: Generate SBOM
      run: |
        curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
        chmod +x $RUNNER_TEMP/sbom-tool
        $RUNNER_TEMP/sbom-tool generate -b ./bin -bc . -pn chef-360 -pv 1.0.0 -ps "Progress Chef" -nsb https://https://www.progress.com/ -V Verbose
    # msftsbom.exe generate -b ./bin -bc . -pn chef-api -pv 0.1.0 -ps "Progress Chef" -nsb "https://chef.io" -V Verbose
   
    - name: Upload MSFTSBOM Artifact
      uses: actions/upload-artifact@v4
      with:
        name: ${{ github.event.repository.name }}-MSFT-manifest.spdx.json
        path: ./bin/_manifest/spdx_2.2/manifest.spdx.json
      
  license_scout:
    # Usage: C:/Ruby32-x64/bin/license_scout (options)
    # -c, --config-files CONFIG_FILES  Comma-separated list of local (or remote) YAML configuration file(s) evaluated in order specified (priority goes to last file)
    # -d, --directories DIRECTORIES    Comma-separated list of directories to scan
    #     --format FORMAT              When exporting a Dependency Manifest, export to this format (valid options: 'csv')
    #     --include-sub-directories    Include all sub-directories of 'directories' in the analysis
    # -l, --log-level LEVEL            Set the log level (valid options: 'debug', 'info', 'warn', 'error', or 'fatal')
    #     --only-show-failures         Only print results for dependencies with licenses that failed checks  
    # -h, --help                       Show this message
    runs-on: ubuntu-latest
    if: ${{ inputs.license_scout == true }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v6
      
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: 'stable'
#        go-version: 1.24.2
#        check-latest: true
        
      - name: Configure git for private modules
        env:
          GOPRIVATE: ${{ inputs.go-private-modules }}
        run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"

      - name: set up license_scout
        uses: ruby/setup-ruby@v1
        with:
            ruby-version: '3.4'
      - name: install license_scout
        run: |
          gem install license_scout
          mkdir -p ./bin/license-scout
      - name: generate license_scout with fallback
# TODO: download license_scout.yml from the repo
        if: ${{ hashFiles('./.license_scout.yml') != '' }}    
        run: license_scout -l debug --format 'csv' -c ./.license_scout.yml > ./bin/license-scout/license-scout.txt 2>&1
      #license_scout -l info --format csv > ./bin/license-scout/license-scout.txt       
      - name: generate license_scout without fallback file
        if: ${{ hashFiles('./.license_scout.yml') == '' }}
        run: license_scout > ./bin/license-scout/license-scout.txt 

      - name: Upload the Artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.event.repository.name }}-license-scout.txt
          path: ./bin/license-scout/license-scout.txt