philips-labs/blackduck-scanner-action

BlackDuck GItHub Action

blackduck-scanner-action's Issues

Support additional .NET Core Nuget scanner through action

Currently the way the scanner action is built, it uses the node variant of the blackduck-docker image.

There doesn't seem to be a way to easily pass in the base image to be used for the execution.

We need a way to support scanning .NET Core projects via this action. I see the blackduck-docker image has tags specific to .NET Core.

Could we change this action to be a composite run steps based action which then builds the action's Dockerfile passing in the required docker image tag as an argument and then executes it.

I am available to contribute 🖐️ , need to agree on direction

Getting errors even after added project name and version name in the workflow

Hi,

Thanks for your action but i am getting few errors even after adding project name and version name from Blackduck.
Here are the errors i got it when i execute my workflow:
i have passed my details as:
blackduck-url: https://blackduck.philips.com/
blackduck-token: ${{ secrets.BLACKDUCK_TOKEN_HTH }}
project: ES_saas-factory-edi-apigateway
version: saas-factory-edi-apigateway

and the errors are:

• getting project api base url
  /get-blackduck-report.sh: line 34: [: null: integer expression expected
  | got project api base url: null

• getting version api base url
  /get-blackduck-report.sh: line 46: [: -eq: unary operator expected
  | got version api base url:

• creating SBOM report
  | triggered creating SBOM report

• getting SBOM report api base url
  | attempt 1 of 50 to get SDPX report
  ERROR: report_status is not COMPLETED, it is .
  | - report_status:
  ##[debug]Docker Action run completed with exit code 1

Add flag to wait for the blackduck result

Capture job id and query status of the query. Add a flag in the action that allows you to get notified when the BlackDuck result is in.

Args:`extraArgs` are ignored.

The extraArgs are ignored...

Deprecate this action. Use official Synopsys action in stead.

Proposal

Deprecate this action, because we are pushing people to use the official SynopSys Detect action: https://github.com/synopsys-sig/detect-action

Actions

• Add deprecation for this action
• Add documentation how to migrate to the Detect-action