cyclonedx / gh-node-module-generatebom

GitHub action to generate a CycloneDX SBOM for Node.js

GitHub action to generate a CycloneDX SBOM for Node.js

This GitHub action will create a a valid CycloneDX Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies. CycloneDX is a lightweight SBOM specification that is easily created, human and machine readable, and simple to parse.

This GitHub action requires a node_modules directory so this action will typically need to run after an npm build.

Inputs

path

The path to a Node.js project, default is "./"

Be sure to quote paths with spaces.

output

Output filename, default is "./bom.xml"

Be sure to quote paths with spaces.

Example simple usage

uses: CycloneDX/gh-node-module-generatebom@v1

Example step that defines the output and path (both are optional)

- name: Create SBOM step
  uses: CycloneDX/gh-node-module-generatebom@v1
  with:
    path: './node_project/'
    output: './bom_directory/test.app.bom.xml'

Complete Action with npm build and SBOM creation

name: Build javascript project
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    name: Install and build javascript
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '16'
      - run: npm install
      - name: Create SBOM with CycloneDX
        uses: CycloneDX/gh-node-module-generatebom@v1
        with: 
          output: './test.app.bom.xml'

Internals

This action uses @cyclonedx/bom@<4. See @cyclonedx/bom in NPMjs.

gh-node-module-generatebom's Issues

use node version in an active LTS version.

currently node12 is used - see https://github.com/CycloneDX/gh-node-module-generatebom/blob/master/action.yml#L14
better use a active LTS version - see https://nodejs.org/en/about/releases/

the chosen node version must be compatible to https://github.com/CycloneDX/cyclonedx-node-module
as it is installed and used in the action - see https://github.com/CycloneDX/gh-node-module-generatebom/blob/master/index.js#L28

JSON option throws warning

The json option was removed in commit 151e37a , but only from the README.md and action.yml files

This means that JSON output is still possible, for example using:

      - uses: CycloneDX/[email protected]
        with:
          json: true

and the JSON output is obtained after displaying a warning: Warning: Unexpected input(s) 'json', valid inputs are ['path', 'output']

Could we reinstate the use of json option and get rid of the warning from action.yml? This would be my preferred outcome rather than removing json option altogether

[IDEA] make universal

current implementation utilizes https://github.com/CycloneDX/cyclonedx-node-module/
in version @<4
v3 is deprecated. v4 became a meta package, utilizing special implmentations for npm, pnpm, yarn, ...

GOAL: rework this GH action:

• input (intended to be as much backward compatible as possible, to not break users of @master version to much)
  • path to the project dir - default to ./
  • cyclonedx-version: {1.4, 1.3, ...} - default to latest`
  • output: output file - default to ./bom.xml
  • package-manager: {npm, pnpm, yarn, yarn2}
• it is expected that the env anlready has a node env setup and the packagemanager is installed.
• auto-detection: based on lock file type
  • it could detect existence of {npm,pnpm,yarn}-lockfile
• process:
  • if the tools are not yet available in the current target env, then
    the needed appropriate tools are installed with the according eco system (npx i/pnpm add,yarn add) in a temp dir
  • the appropriate application is run from that temp dir
  • if there is no appropriate application (yet) the GH action exists with an error, prints a info message.

---

internally

• utilize https://github.com/CycloneDX/cyclonedx-node-npm
• utilize https://github.com/CycloneDX/cyclonedx-node-pnpm
• utilize https://github.com/CycloneDX/cyclonedx-node-yarn

---

change process:

• write the docs with: use @v1 - instead of @master
• current master becomes available as git branch 1.x
• next version is properly tagged as v2 and so on ...
• ⚠️ since there might be uses that run directly on @master - the master branch must be working all the time - do development in a dedicated temp branch !

add some tests

it would be good to add some testing, minimal would certainly do the job

There is an example of a very fully featured set of tests run by anchore/sbom-action

:mega: migrate to `@cyclonedx/cyclonedx-npm` ???

current implementation of this GitHub action uses an outdated and unmaintained version of @cyclonedx/bom < 4.

should this GitHub action be migrated to @cyclonedx/cyclonedx-npm?
If you like the idea, give this issue thumbs up, or write a comment.