Skip to content

Project Ideas Create GitHub SBOM action

Philippe Ombredanne edited this page Mar 10, 2022 · 1 revision

This is about to create a scan using a GitHub action, optionally also creating SPDX and CycloneDX outputs. The actions should:

  1. scan with ScanCode toolkit
  2. store the scans in JSON. Also store CycloneDX and SPDX
  3. establish some "failure" conditions based on thing such as: 3.1 a run of DeltaCode and fail on specific changes 3.2 a "policy" violation where specific licenses are found 3.3 other similar conditions based on a certain packages, email, URLs or copyright presence or absence
  4. design a way to mark failures conditions or policy exceptions as accepted.

This is a medium to large size project idea.

Clone this wiki locally