docker / docker/build-push-action
Export SBOM locally
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5.4k
- Forks
- 735
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 14
Description
Right now in my workflow I need to scan the newly created image with something like grype, then upload the SARIF to GitHub to see Code Scanning alerts.
I'd like to be able to at least skip a step and give grype the SBOM created by this action as an input. I think the SBOM might even be more accurate compared to the scan that grype performs since the SBOM is created at build time and might have more data if for example BUILDKIT_SBOM_SCAN_STAGE was used (I haven't confirmed this).
This is somewhat related to https://github.com/docker/build-push-action/issues/861 I think, but submitting the SBOM to GitHub doesn't do any scanning for vulnerabilities as far as I can tell.
It's probably out of scope for this action to generate a SARIF that can be uploaded to GitHub (or even automatically pushed), but just throwing the idea out there 🙂
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how this GitHub Action produces its SBOM during the Docker BuildKit workflow, including the possible BUILDKIT_SBOM_SCAN_STAGE setting. Compare the available output with grype's expected SBOM input and define how a user would retrieve it locally; done means the generated SBOM can be consumed without requiring a GitHub upload.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, typescript
- Domain
- ci-cd, devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100