action.yml

name: 'CVE Binary Tool'
description: "CVE Binary Tool's official GitHub Action"
author: 'b31ngd3v'
branding:
  icon: 'shield'
  color: 'gray-dark'
inputs:
  scan_mode:
    required: false
    default: 'repo-only'
    description: 'Valid scan modes are both, repo-only, sbom-only. (default: repo-only)'
  nvd_api_key:
    required: false
    description: 'NVD API Key is required for downloading National Vulnerbility Database.'
  exclude_dir:
    required: false
    description: 'While scanning, CVE Binary Tool will ignore these directories.'
  build_command:
    required: false
    description: 'It will run the build_command before running CVE Binary Tool on the build output and the repository content.'
  sbom_type:
    required: false
    description: 'Valid SBOM types are spdx, cyclonedx. (default: spdx)'
  sbom_format:
    required: false
    description: 'Valid SBOM formats are tag, json, yaml. (default: json)'
  alerts_based_on_file:
    required: false
    default: false
    description: 'Split security alerts based on source file.'
  vex_file:
    required: false
    description: 'Provide input filename for triage data.'
  filter_triage:
    required: false
    default: true
    description: 'Filter vulnerabilities based on triage data.'
runs:
  using: 'composite'
  steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-python@v5.4.0
      with:
        python-version: '3.13'
    - uses: actions/cache@v4
      with:
        path: ~/.cache/pip
        key: 'python3-pip'
    - run: pip install git+https://github.com/intel/cve-bin-tool@main reportlab
      shell: bash
    - run: >
        python3 "${GITHUB_ACTION_PATH}/src/scanner.py" .
        --scan-mode '${{ inputs.scan_mode }}'
        --repo '${{ github.repository }}'
        --run-id '${{ github.run_id }}'
        --html-pdf-output "./scan-result"
        --sarif-output "/tmp/scan-report.sarif"
        --nvd-api-key '${{ inputs.nvd_api_key }}'
        --exclude-dir '${{ inputs.exclude_dir }}'
        --build-command '${{ inputs.build_command }}'
        --sbom-output 'SBOM'
        --sbom-type '${{ inputs.sbom_type }}'
        --sbom-format '${{ inputs.sbom_format }}'
        --alerts-based-on-file '${{inputs.alerts_based_on_file}}'
        --vex-file '${{ inputs.vex_file }}'
        --filter-triage '${{inputs.filter_triage}}'
      shell: bash
    - uses: actions/upload-artifact@v4
      with:
        name: cve_reports
        path: |
          scan-result.html
          scan-result.pdf
          SBOM.json
          SBOM.spdx
          SBOM.spdx.json
          SBOM.spdx.yml
        if-no-files-found: ignore
    - uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: /tmp/scan-report.sarif
    - run: rm -f scan-result.html scan-result.pdf scan-result.json
      shell: bash