ChatGPT MCP
405cf7df9c
Managed validation / full (pull_request) Successful in 14s
GeoIntel release gates / Trusted workflow source (pull_request) Successful in 3s
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Failing after 1m2s
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Successful in 35s
GeoIntel release gates / GIS image, SBOM and container scan (pull_request) Successful in 5m29s
GeoIntel release gates / AI image, SBOM and container scan (pull_request) Failing after 19m14s
50 lines
1.4 KiB
Bash
50 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:-geointel-ci:local}"
|
|
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
|
|
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
|
|
TMP_DIR="$(mktemp -d)"
|
|
SYFT_CONTAINER=""
|
|
|
|
cleanup() {
|
|
if [ -n "$SYFT_CONTAINER" ]; then
|
|
docker rm -f "$SYFT_CONTAINER" >/dev/null 2>&1 || true
|
|
fi
|
|
rm -rf "$TMP_DIR"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
case "$OUTPUT" in
|
|
/*|*..*)
|
|
echo "SBOM output must be a repository-relative path without '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
docker image inspect "$TARGET_IMAGE" >/dev/null
|
|
mkdir -p "$ROOT/$(dirname "$OUTPUT")"
|
|
|
|
# Keep Syft supply-chain pinned to the audited container image, but execute the
|
|
# extracted static binary in the Actions job itself. This lets Syft use the
|
|
# job's existing DOCKER_HOST directly and avoids a second scanner-container ->
|
|
# host-gateway -> DinD network hop for large AI images.
|
|
if ! docker image inspect "$SYFT_IMAGE" >/dev/null 2>&1; then
|
|
docker pull "$SYFT_IMAGE" >/dev/null
|
|
fi
|
|
SYFT_CONTAINER="$(docker create "$SYFT_IMAGE")"
|
|
docker cp "$SYFT_CONTAINER:/syft" "$TMP_DIR/syft"
|
|
docker rm "$SYFT_CONTAINER" >/dev/null
|
|
SYFT_CONTAINER=""
|
|
chmod +x "$TMP_DIR/syft"
|
|
|
|
SYFT_CHECK_FOR_APP_UPDATE=false \
|
|
"$TMP_DIR/syft" \
|
|
"$TARGET_IMAGE" \
|
|
--from docker \
|
|
-o spdx-json > "$ROOT/$OUTPUT"
|
|
|
|
test -s "$ROOT/$OUTPUT"
|
|
echo "SBOM written to $OUTPUT"
|