ChatGPT MCP
27bc2ebf70
GeoIntel release gates / Trusted workflow source (pull_request) Canceled after 0s
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Canceled after 0s
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Canceled after 0s
GeoIntel release gates / GIS image, SBOM and container scan (pull_request) Canceled after 0s
GeoIntel release gates / AI image, SBOM and container scan (pull_request) Canceled after 0s
53 lines
1.7 KiB
Bash
53 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:-geointel-ci:local}"
|
|
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
|
|
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
|
|
SCANNER_ENGINE_ARGS=()
|
|
|
|
case "$OUTPUT" in
|
|
/*|*..*)
|
|
echo "SBOM output must be a repository-relative path without '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
configure_scanner_engine() {
|
|
local docker_host="${DOCKER_HOST:-}"
|
|
if [[ "$docker_host" == tcp://* ]]; then
|
|
local port="${docker_host##*:}"
|
|
if ! [[ "$port" =~ ^[0-9]+$ ]] || (( port < 1 || port > 65535 )); then
|
|
echo "Unsupported TCP Docker host for nested scanner: $docker_host" >&2
|
|
exit 1
|
|
fi
|
|
SCANNER_ENGINE_ARGS=(
|
|
--add-host host.docker.internal:host-gateway
|
|
-e "DOCKER_HOST=tcp://host.docker.internal:${port}"
|
|
)
|
|
elif [[ -z "$docker_host" || "$docker_host" == unix:///var/run/docker.sock ]]; then
|
|
SCANNER_ENGINE_ARGS=(-v /var/run/docker.sock:/var/run/docker.sock)
|
|
else
|
|
echo "Unsupported Docker host for nested scanner: $docker_host" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
docker image inspect "$TARGET_IMAGE" >/dev/null
|
|
mkdir -p "$ROOT/$(dirname "$OUTPUT")"
|
|
configure_scanner_engine
|
|
|
|
# Native/local runs use the normal Unix socket. Gitea jobs can target the
|
|
# isolated TCP DinD daemon; scanner containers then reach that same daemon via
|
|
# Docker's host-gateway alias instead of receiving the Unraid host socket.
|
|
docker run --rm \
|
|
"${SCANNER_ENGINE_ARGS[@]}" \
|
|
"$SYFT_IMAGE" \
|
|
"$TARGET_IMAGE" \
|
|
--from docker \
|
|
-o spdx-json > "$ROOT/$OUTPUT"
|
|
|
|
test -s "$ROOT/$OUTPUT"
|
|
echo "SBOM written to $OUTPUT"
|