philips-labs/blackduck-scanner-action

BlackDuck GItHub Action

Philips - Labs

1. Purpose
2. What type of repositories
3. What can I open source
4. Other Philips-Software
5. Who should use this
6. Can I join
7. Innersource
8. Philips Organizations
9. Contact

Purpose

This organization will be used for Philips labs repositories. These projects are typically under development.

What type of repositories?

• Early development
• Demo repositories
• Small experiments
• Examples

What can I open source?

See: https://www.philips.com/opensource (Internal link).

Where can I find the other open source projects from Philips?

https://github.com/philips-software https://github.com/philips-forks

Who should use this?

People within Philips can use this.

Can I join?

Send an email to: @jeroenknoops with a short motivation and we will add you.

Can I use this for Innersource?

No, please go to https://github.com/philips-internal.
Head over to https://www.philips.com/innersource for more information (internal link).

Philips Organizations

Organization	Type	Typical projects	Repository visibilit	Rules
philips-software	Open Source	Mature projects	Public	here
philips-labs	Open Source	Hackathons, demos, development	Public	here
philips-forks	Open Source	Forks of existing projects	Public	here
philips-internal	Inner Source	All other projects	Internal / Private	here

Who to contact?

Contact @jeroenknoops

blackduck-scanner-action's Issues

Getting errors even after added project name and version name in the workflow

Hi,

Thanks for your action but i am getting few errors even after adding project name and version name from Blackduck.
Here are the errors i got it when i execute my workflow:
i have passed my details as:
blackduck-url: https://blackduck.philips.com/
blackduck-token: ${{ secrets.BLACKDUCK_TOKEN_HTH }}
project: ES_saas-factory-edi-apigateway
version: saas-factory-edi-apigateway

and the errors are:

• getting project api base url
  /get-blackduck-report.sh: line 34: [: null: integer expression expected
  | got project api base url: null

• getting version api base url
  /get-blackduck-report.sh: line 46: [: -eq: unary operator expected
  | got version api base url:

• creating SBOM report
  | triggered creating SBOM report

• getting SBOM report api base url
  | attempt 1 of 50 to get SDPX report
  ERROR: report_status is not COMPLETED, it is .
  | - report_status:
  ##[debug]Docker Action run completed with exit code 1

Support additional .NET Core Nuget scanner through action

Currently the way the scanner action is built, it uses the node variant of the blackduck-docker image.

There doesn't seem to be a way to easily pass in the base image to be used for the execution.

We need a way to support scanning .NET Core projects via this action. I see the blackduck-docker image has tags specific to .NET Core.

Could we change this action to be a composite run steps based action which then builds the action's Dockerfile passing in the required docker image tag as an argument and then executes it.

I am available to contribute 🖐️ , need to agree on direction

Add flag to wait for the blackduck result

Capture job id and query status of the query. Add a flag in the action that allows you to get notified when the BlackDuck result is in.

Deprecate this action. Use official Synopsys action in stead.

Proposal

Deprecate this action, because we are pushing people to use the official SynopSys Detect action: https://github.com/synopsys-sig/detect-action

Actions

• Add deprecation for this action
• Add documentation how to migrate to the Detect-action

Args:`extraArgs` are ignored.

The extraArgs are ignored...