cyclonedx / gh-dotnet-generate-sbom

GitHub action to generate a CycloneDX SBOM for .NET

GitHub action to generate a CycloneDX SBOM for .NET

Inputs

path

Required The path to a .sln, .csproj, .vbproj, or packages.config file or the path to a directory which will be recursively analyzed for packages.config files.

Be sure to quote paths with spaces.

out

Output directory, default is "./"

Be sure to quote paths with spaces.

json

Produce a JSON BOM instead of XML, set to any value instead of false.

github-bearer-token

Optionally provide the GitHub action bearer token for license resolution (example below).

Example usage

- name: Generate XML SBOM
  uses: CycloneDX/gh-dotnet-generate-sbom@v1
  with:
    path: ./CycloneDX.sln
    github-bearer-token: ${{ secrets.GITHUB_TOKEN }}

- name: Generate JSON SBOM
  uses: CycloneDX/gh-dotnet-generate-sbom@master
  with:
    path: ./CycloneDX.sln
    json: true
    github-bearer-token: ${{ secrets.GITHUB_TOKEN }}

gh-dotnet-generate-sbom's Issues

Support github bearer tokens for license resolution

Use of deprecated node versions

This action is still using node node12. When I use it, I get a warning of a deprecated node version. Could this be updated to the latest Node version?

Incorrect BOM results

Summary

In my PANSearcher repository, I have couple of Nuget dependencies but the result is totally different and incorrect.

Expected result

No PANHunter reference should be there. Nuget packages might be listed.

Evidence

bom.xml

<?xml version="1.0" encoding="utf-8"?>
<bom xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" serialNumber="urn:uuid:27c79928-b624-4285-9f12-cb6da3b60fc2" version="1" xmlns="http://cyclonedx.org/schema/bom/1.3">
	<metadata>
		<tools>
			<tool>
				<vendor>CycloneDX</vendor>
				<name>CycloneDX module for .NET</name>
				<version>2.3.0.0</version>
			</tool>
		</tools>
		<component type="application" bom-ref="[email protected]">
			<name>PANHunter</name>
			<version>0.0.0</version>
		</component>
	</metadata>
	<components />
	<dependencies>
		<dependency ref="[email protected]" />
	</dependencies>
</bom>

bom.json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.3",
  "serialNumber": "urn:uuid:d7696838-a4c7-4a42-8e6a-d9a92c9ef88d",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "vendor": "CycloneDX",
        "name": "CycloneDX module for .NET",
        "version": "2.3.0.0"
      }
    ],
    "component": {
      "type": "application",
      "bom-ref": "[email protected]",
      "name": "PANHunter",
      "version": "0.0.0"
    }
  },
  "components": [],
  "dependencies": [
    {
      "ref": "[email protected]",
      "dependsOn": []
    }
  ]
}