For market approval of a Medical Device by a regulatory or notified body, evidence of compliance
with regulatory requirements (IEC 62304, FDA QSR, MDR etc...). This includes the software development process,
such as the requirements, design, implementation, verification, and validation. This GitHub Action captures
evidence from each software build in your CD pipeline as it is generated and stores them as a
Technical file (DHF) using Coauthor, ready for submission for regulatory approval.
This action doesn't require an API key or storing another secret, but it does require access to the OIDC token from GitHub's OIDC provider. OIDC tokens are GitHub's recommended way to authenticate from GitHub actions with external systems. An OIDC token is short-lived credential uniquely generated for each GH Actions workflow run. The token includes claims about the workflow run, such as the repository, the workflow, branch, commit sha and the run number, and Coauthor uses these claims to add the correct information to a DHF technical file and demostrates a chain of custody.
To get this to work you will need to configure your workflow to use the id-token: write
permission.
permissions:
id-token: write
contents: read
Option | Description | Required |
---|---|---|
path |
A file, directory or wildcard pattern of evidence to be uploaded from the GH workflow run | Yes |
switem |
The Software Item (IEC 62340) the evidence is associated with. Defaults to system |
No |
evidence |
The evidence category: system-verification , integration-verification , cybersecurity |
Yes |
type |
The type of evidence: bdd , sbom |
Yes |
format |
The file format of the evidence: cucumber+ndjson , cyclonedx |
Yes |
hostname |
The hostname of the Coauthor server | Yes |
How to upload test results from Cucumber in the ndjson message format. Cucumber has number of
report formatters to
choose from, this common with compatibility across the different programming language supported by the Cucumber family
is the message formatter: cucumber-js --format message:./reports/bdd/cucumber-messages.ndjson"
uses: coauthor-app/capture-action@main
with:
evidence: 'system-verification'
type: 'bdd'
format: 'cucumber+ndjson'
path: 'reports/bdd/**'
How to upload a Software Bill of Materials (SBOM) in CycloneDX format. CycloneDX is a lightweight SBOM specification that is easily created and consumed by developers, tools, and services. CycloneDX along with SPDX are valid SBOM formats for the FDA'a cybersecurity requirements as long as the tools generating the SBOM supports meet the NTIA's Minimum Elements for Software Bill of Materials (SBOM) in Cybersecurity Risk Management.
Coauthor or this action do not generate an SBOM, but it can capture the SBOM generated by an appropriate tool. We recommend looking at the SBOM Action that uses Syft or the CycloneDX project for more information on generating SBOMs.
uses: coauthor-app/capture-action@main
with:
evidence: 'cybersecurity'
type: 'sbom'
format: 'cyclonedx'
path: 'reports/sbom/**'