Feature/swh #2200
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repo tests | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| paths-ignore: | |
| - 'docs/**' | |
| - '*.md' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: ['22.x'] | |
| os: ['ubuntu-latest', 'windows-latest'] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '21' | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - uses: denoland/setup-deno@v1 | |
| with: | |
| deno-version: v1.x | |
| - uses: oven-sh/setup-bun@v1 | |
| - name: Trim CI agent | |
| run: | | |
| chmod +x contrib/free_disk_space.sh | |
| ./contrib/free_disk_space.sh | |
| - name: Install bazelisk - linux | |
| if: matrix.os == 'ubuntu-latest' | |
| run: | | |
| curl -LO "https://github.com/bazelbuild/bazelisk/releases/download/v1.15.0/bazelisk-linux-amd64" | |
| sudo mv bazelisk-linux-amd64 /usr/local/bin/bazel | |
| - name: Install bazelisk - windows | |
| if: matrix.os == 'windows-latest' | |
| run: choco install -y bazel | |
| - name: npm install, build and test | |
| run: | | |
| npm install | |
| npm run build --if-present | |
| npm test | |
| mkdir -p repotests | |
| mkdir -p bomresults | |
| mkdir -p denoresults | |
| env: | |
| CI: true | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@v3 | |
| - uses: swift-actions/setup-swift@v2 | |
| if: matrix.os == 'ubuntu-latest' | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: 3.11 | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'ShiftLeftSecurity/shiftleft-java-example' | |
| path: 'repotests/shiftleft-java-example' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'ShiftLeftSecurity/shiftleft-ts-example' | |
| path: 'repotests/shiftleft-ts-example' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'ShiftLeftSecurity/shiftleft-go-example' | |
| path: 'repotests/shiftleft-go-example' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'prabhu/shiftleft-scala-example' | |
| path: 'repotests/shiftleft-scala-example' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'HooliCorp/vulnerable_net_core' | |
| path: 'repotests/vulnerable_net_core' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'HooliCorp/Goatly.NET' | |
| path: 'repotests/Goatly.NET' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'HooliCorp/DjanGoat' | |
| path: 'repotests/DjanGoat' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'prabhu/Vulnerable-Web-Application' | |
| path: 'repotests/Vulnerable-Web-Application' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'prabhu/railsgoat' | |
| path: 'repotests/railsgoat' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'bazelbuild/examples' | |
| path: 'repotests/bazel-examples' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'flutter/gallery' | |
| ref: 'v2.10.2' | |
| path: 'repotests/gallery' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'gojek/ziggurat' | |
| ref: '4.9.4' | |
| path: 'repotests/ziggurat' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'apple/swift-markdown' | |
| ref: '0.3.0' | |
| path: 'repotests/swift-markdown' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'GoogleCloudPlatform/microservices-demo' | |
| ref: 'v0.8.1' | |
| path: 'repotests/microservices-demo' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'zoom/meetingsdk-vuejs-sample' | |
| ref: 'v2.18.0' | |
| path: 'repotests/meetingsdk-vuejs-sample' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'sveltejs/examples' | |
| path: 'repotests/sveltejs-examples' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'openpbs/openpbs' | |
| ref: 'v23.06.06' | |
| path: 'repotests/openpbs' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'home-assistant/android' | |
| ref: '2023.11.3' | |
| path: 'repotests/ha-android' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'rust-lang/rust' | |
| ref: '1.74.0' | |
| path: 'repotests/rs-rust' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'rust-lang/cargo' | |
| ref: '0.75.0' | |
| path: 'repotests/rs-cargo' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'Keats/validator' | |
| ref: 'v0.15.0' | |
| path: 'repotests/rs-validator' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'tokio-rs/axum' | |
| ref: 'axum-v0.6.20' | |
| path: 'repotests/rs-axum' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'fsprojects/FAKE' | |
| ref: '6.0.0' | |
| path: 'repotests/dotnet-paket' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'appthreat/blint' | |
| ref: 'v1.0.34' | |
| path: 'repotests/blint' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'hoolicorp/java-sec-code' | |
| path: 'repotests/java-sec-code' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'DefectDojo/django-DefectDojo' | |
| ref: '2.28.2' | |
| path: 'repotests/django-DefectDojo' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'googleprojectzero/Jackalope' | |
| path: 'repotests/Jackalope' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'hritik14/broken-mvn-wrapper' | |
| path: 'repotests/broken-mvn-wrapper' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'microsoft/dotnet-podcasts' | |
| path: 'repotests/dotnet-podcasts' | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: 'microsoft/react-native-windows' | |
| path: 'repotests/react-native-windows' | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: repotests java-sec-code | |
| run: | | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-1.json --include-formulation --include-crypto | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-2.json --author foo --author bar | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-3.json --required-only | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-4.json --filter postgres --filter json | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-5.json --only spring | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-6.json --deep --evidence | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-7.json --profile research --export-proto | |
| bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-8.json --profile license-compliance | |
| shell: bash | |
| - name: repotests evidence | |
| run: | | |
| bin/cdxgen.js -p -t js --no-recurse -o bomresults/bom.json --evidence . | |
| shell: bash | |
| - name: repotests django-DefectDojo | |
| run: | | |
| bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo.json --deep --evidence | |
| shell: bash | |
| - name: repotests shiftleft-java-example | |
| run: | | |
| bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/bom-java.json --generate-key-and-sign | |
| node bin/evinse.js -i bomresults/bom-java.json -o bomresults/bom-java.evinse.json -l java --with-data-flow -p repotests/shiftleft-java-example | |
| SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/bom-github.json | |
| shell: bash | |
| - name: repotests shiftleft-ts-example | |
| run: | | |
| FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/shiftleft-ts-example -o bomresults/bom-ts-1.json --include-formulation | |
| node bin/evinse.js -i bomresults/bom-ts-1.json -o bomresults/bom-ts.evinse.json -l javascript --with-data-flow -p repotests/shiftleft-ts-example | |
| FETCH_LICENSE=true bin/cdxgen.js -p -t js repotests/shiftleft-ts-example --required-only -o bomresults/bom-ts-2.json --validate | |
| FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/bom-ts-3.json --validate | |
| shell: bash | |
| - name: repotests meetingsdk-vuejs-sample | |
| run: | | |
| FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/meetingsdk-vuejs-sample -o bomresults/bom-vue.json | |
| node bin/evinse.js -i bomresults/bom-vue.json -o bomresults/bom-vue.evinse.json -l javascript --with-data-flow -p repotests/meetingsdk-vuejs-sample | |
| shell: bash | |
| - name: repotests sveltejs-examples | |
| run: | | |
| CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/sveltejs-examples -o bomresults/bom-svelte.json | |
| CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" node bin/evinse.js -i bomresults/bom-svelte.json -o bomresults/bom-svelte.evinse.json -l javascript --with-data-flow -p repotests/sveltejs-examples | |
| CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" node bin/evinse.js -i bomresults/bom-svelte.json -o bomresults/bom-svelte.evinse.json -l javascript --with-reachables -p repotests/sveltejs-examples | |
| shell: bash | |
| - name: repotests shiftleft-go-example | |
| run: | | |
| FETCH_LICENSE=false bin/cdxgen.js -p -r -t go repotests/shiftleft-go-example -o bomresults/bom-go.json --validate --export-proto | |
| shell: bash | |
| - name: repotests vulnerable_net_core | |
| run: | | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/bom-csharp2.json --include-formulation | |
| shell: bash | |
| - name: repotests Goatly.NET | |
| run: | | |
| FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/bom-csharp3.json --include-formulation | |
| shell: bash | |
| - name: repotests DjanGoat | |
| run: | | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/bom-python.json --validate | |
| shell: bash | |
| - name: repotests Vulnerable-Web-Application | |
| run: | | |
| bin/cdxgen.js -p -t php repotests/Vulnerable-Web-Application -o bomresults/bom-php-1.json --validate | |
| bin/cdxgen.js -p -t php --no-recurse repotests/Vulnerable-Web-Application -o bomresults/bom-php-2.json --validate --profile research -p | |
| shell: bash | |
| - name: repotests railsgoat | |
| run: | | |
| bin/cdxgen.js -p -r -t ruby repotests/railsgoat -o bomresults/bom-ruby.json --validate | |
| shell: bash | |
| - name: repotests bazel-examples | |
| run: | | |
| bin/cdxgen.js -p -r -t java repotests/bazel-examples/java-maven -o bomresults/bom-bazel.json --validate | |
| shell: bash | |
| - name: repotests gallery | |
| run: | | |
| bin/cdxgen.js -p -r -t dart repotests/gallery -o bomresults/bom-pub.json --validate | |
| shell: bash | |
| - name: repotests ziggurat | |
| run: | | |
| CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t clojure repotests/ziggurat -o bomresults/bom-clj.json --validate | |
| shell: bash | |
| - name: repotests swift-markdown | |
| run: | | |
| CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t swift repotests/swift-markdown -o bomresults/bom-swift.json --validate | |
| shell: bash | |
| - name: repotests microservices-demo | |
| if: matrix.os == 'windows-latest' | |
| run: | | |
| bin/cdxgen.js -p --no-recurse repotests/microservices-demo -o bomresults/bom-msd-1.json --validate | |
| bin/cdxgen.js -p -r repotests/microservices-demo -o bomresults/bom-msd-2.json --validate | |
| bin/cdxgen.js -p -r -t yaml-manifest repotests/microservices-demo -o bomresults/bom-yaml.json --validate | |
| shell: bash | |
| - name: repotests openpbs | |
| run: | | |
| bin/cdxgen.js -p -r -t c repotests/openpbs -o bomresults/bom-openpbs.json | |
| shell: bash | |
| - name: repotests Jackalope | |
| run: | | |
| bin/cdxgen.js -p -r -t c repotests/Jackalope -o bomresults/bom-Jackalope.json | |
| shell: bash | |
| - name: repotests ha-android | |
| run: | | |
| cd repotests/ha-android && ./gradlew assembleDebug || true && cd ../.. | |
| bin/cdxgen.js -r -t java repotests/ha-android -o bomresults/bom-android.json | |
| CDXGEN_DEBUG_MODE=debug bin/evinse.js -i bomresults/bom-android.json -o bomresults/bom-android.evinse.json -l java repotests/ha-android | |
| shell: bash | |
| - name: repotests rust | |
| run: | | |
| bin/cdxgen.js -p -r -t rust repotests/rs-rust -o bomresults/bom-rs-rust.json --validate | |
| bin/cdxgen.js -p -r -t rust repotests/rs-cargo -o bomresults/bom-rs-cargo.json --validate | |
| cargo generate-lockfile --manifest-path repotests/rs-validator/validator/Cargo.toml | |
| bin/cdxgen.js -p -r -t rust repotests/rs-validator -o bomresults/bom-rs-validator.json --validate | |
| bin/cdxgen.js -p -r -t rust repotests/rs-axum -o bomresults/bom-rs-axum.json --validate | |
| shell: bash | |
| - name: repotests dotnet-paket | |
| run: | | |
| bin/cdxgen.js -p -r -t dotnet repotests/dotnet-paket -o bomresults/bom-dotnet-paket.json --validate | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t dotnet repotests/dotnet-paket -o bomresults/bom-dotnet-paket-2.json --validate | |
| bin/cdxgen.js -p -r -t dotnet repotests/dotnet-podcasts -o bomresults/bom-dotnet-podcasts.json --profile research --export-proto | |
| bin/cdxgen.js -p -r -t dotnet repotests/react-native-windows -o bomresults/bom-react-native-windows.json | |
| shell: bash | |
| - name: repotests blint | |
| run: | | |
| bin/cdxgen.js -p -t python repotests/blint -o bomresults/bom-blint.json | |
| bin/cdxgen.js -p -t python repotests/blint -o bomresults/bom-blint-deep.json --deep | |
| bin/cdxgen.js -p -t java repotests/broken-mvn-wrapper -o bomresults/bom-broken-mvn-wrapper.json | |
| shell: bash | |
| - name: jenkins plugins | |
| run: | | |
| mkdir -p jenkins | |
| curl -LO https://updates.jenkins.io/download/plugins/sonar/2.14/sonar.hpi | |
| curl -LO https://updates.jenkins.io/download/plugins/bouncycastle-api/2.26/bouncycastle-api.hpi | |
| curl -LO https://updates.jenkins.io/download/plugins/jsch/0.1.55.61.va_e9ee26616e7/jsch.hpi | |
| curl -LO https://updates.jenkins.io/download/plugins/momentjs/1.1.1/momentjs.hpi | |
| mv *.hpi jenkins | |
| CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t jenkins jenkins -o bomresults/bom-jenkins.json --validate | |
| shell: bash | |
| - name: standalone jar files | |
| run: | | |
| mkdir -p standalone-jar-files | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jacoco/org.jacoco.report/0.8.8/org.jacoco.report-0.8.8.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/ws/xmlschema/xmlschema-core/2.2.5/xmlschema-core-2.2.5.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.0/jackson-core-2.16.0.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/wsdl4j/wsdl4j/1.6.3/wsdl4j-1.6.3.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/maven/maven-core/3.9.2/maven-core-3.9.2.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/displaytag/displaytag/1.2/displaytag-1.2.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/poi/poi/3.17/poi-3.17.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jacoco/org.jacoco.agent/0.8.8/org.jacoco.agent-0.8.8.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/javax/jws/javax.jws-api/1.1/javax.jws-api-1.1.jar | |
| curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jrobin/jrobin/1.5.9/jrobin-1.5.9.jar | |
| FETCH_LICENSE=true bin/cdxgen.js -p standalone-jar-files -o bomresults/bom-standalone-jar-files.json --validate | |
| shell: bash | |
| - name: post-build lifecycle tests | |
| run: | | |
| pip install blint | |
| mkdir -p bintests | |
| cd bintests | |
| curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai.exe | |
| curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai | |
| curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai-osx-arm64 | |
| cd .. | |
| bin/cdxgen.js -p -t dotnet --lifecycle post-build -o bomresults/bom-binary.json bintests | |
| mkdir -p gobintests | |
| cd gobintests | |
| curl -LO https://github.com/anchore/syft/releases/download/v1.0.1/syft_1.0.1_linux_arm64.tar.gz | |
| tar -xvf syft_1.0.1_linux_arm64.tar.gz | |
| rm syft_1.0.1_linux_arm64.tar.gz | |
| curl -LO https://github.com/containerd/containerd/releases/download/v2.0.0-rc.0/containerd-static-2.0.0-rc.0-linux-amd64.tar.gz | |
| tar -xvf containerd-static-2.0.0-rc.0-linux-amd64.tar.gz | |
| rm containerd-static-2.0.0-rc.0-linux-amd64.tar.gz | |
| cd .. | |
| bin/cdxgen.js -p -t go --lifecycle post-build -o bomresults/bom-go-binary.json gobintests | |
| shell: bash | |
| - name: repotests 1.6 | |
| run: | | |
| bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/1.6-bom-java.json --generate-key-and-sign --spec-version 1.6 | |
| SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/1.6-bom-github.json --spec-version 1.6 | |
| FETCH_LICENSE=0 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/1.6-bom-ts-1.json --validate --spec-version 1.6 | |
| FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example --required-only -o bomresults/1.6-bom-ts-2.json --validate --spec-version 1.6 | |
| FETCH_LICENSE=false bin/cdxgen.js -p -r -t go repotests/shiftleft-go-example -o bomresults/1.6-bom-go.json --validate --spec-version 1.6 | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/1.6-bom-csharp2.json --validate --spec-version 1.6 | |
| FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/1.6-bom-csharp3.json --validate --spec-version 1.6 | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/1.6-bom-python.json --validate --spec-version 1.6 | |
| bin/cdxgen.js -p -r -t php repotests/Vulnerable-Web-Application -o bomresults/1.6-bom-php.json --validate --spec-version 1.6 | |
| shell: bash | |
| - name: repotests 1.4 | |
| run: | | |
| bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/1.4-bom-java.json --generate-key-and-sign --spec-version 1.4 | |
| SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/1.4-bom-github.json --spec-version 1.4 | |
| FETCH_LICENSE=0 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/1.4-bom-ts-1.json --validate --spec-version 1.4 | |
| FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example --required-only -o bomresults/1.4-bom-ts-2.json --validate --spec-version 1.4 | |
| FETCH_LICENSE=false bin/cdxgen.js -p -r -t go repotests/shiftleft-go-example -o bomresults/1.4-bom-go.json --validate --spec-version 1.4 | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/1.4-bom-csharp2.json --validate --spec-version 1.4 | |
| FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/1.4-bom-csharp3.json --validate --spec-version 1.4 | |
| FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/1.4-bom-python.json --validate --spec-version 1.4 | |
| bin/cdxgen.js -p -r -t php repotests/Vulnerable-Web-Application -o bomresults/1.4-bom-php.json --validate --spec-version 1.4 | |
| shell: bash | |
| - name: list repotest bomresults | |
| run: | | |
| ls -ltr bomresults | |
| shell: bash | |
| - name: buntests | |
| run: | | |
| rm -rf node_modules | |
| bun install --frozen-lockfile | |
| bun --bun bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-bun.json --deep | |
| bun --bun bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-bun.json | |
| continue-on-error: true | |
| - name: denotests | |
| run: | | |
| deno info bin/cdxgen.js | |
| deno info bin/evinse.js | |
| deno run --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid --allow-write --allow-net bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-deno.json | |
| deno run --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid --allow-write --allow-net bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-deno.json | |
| - uses: actions/upload-artifact@v4 | |
| if: github.ref == 'refs/heads/master' && matrix.os == 'ubuntu-latest' | |
| with: | |
| name: bomresults | |
| path: bomresults |