gh-upload-sbom/action.yml at master · DependencyTrack/gh-upload-sbom · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: 'Upload BOM to Dependency-Track'
author: Patrick Dwyer
description: 'Uploads a CycloneDX software bill of materials to a Dependency-Track server'
inputs:
  server-hostname:
    description: 'Dependency-Track hostname'
    required: true
  port:
    description: 'Dependency-Track port'
    required: false
    default: '443'
  protocol:
    description: 'Dependency-Track protocol'
    required: false
    default: 'https'
  api-key:
    description: 'Dependency-Track API key (required unless workload-identity-provider is set)'
    required: false
  workload-identity-provider:
    description: 'Name of the workload identity provider in Dependency-Track to exchange the GitHub OIDC token with, instead of using api-key (available in DT v5.2.0 and later)'
    required: false
  service-account:
    description: 'Name of the Dependency-Track service account to act as when using workload-identity-provider'
    required: false
  oidc-audience:
    description: 'Audience of the GitHub OIDC token, must match the audience of the workload identity provider (required when using workload-identity-provider)'
    required: false
  project:
    description: 'Project in Dependency-Track'
    required: false
  project-name:
    description: 'Project name in Dependency-Track'
    required: false
  project-version:
    description: 'Project version in Dependency-Track'
    required: false
  project-tags:
    description: 'Comma-separated list of tags (available in DT v4.12 and later)'
    required: false
  auto-create:
    description: "Automatically create the project in Dependency-Track if it doesn't exist (defaults to false)"
    required: false
  bom-filename:
    description: 'Path and filename of the BOM (defaults to bom.xml)'
    required: false
  parent:
    description: 'Parent project UUID in Dependency-Track (available in DT v4.8 and later)'
    required: false
  parent-name:
    description: 'Parent project name in Dependency-Track (available in DT v4.8 and later)'
    required: false
  parent-version:
    description: 'Parent project version in Dependency-Track (available in DT v4.8 and later)'
    required: false
  is-latest:
    description: 'Set the property isLatest to the uploaded Version (defaults to false)'
    required: false
  #
  # Deprecated inputs.
  #
  serverhostname:
    description: 'DEPRECATED: use server-hostname instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'server-hostname' instead. Will be removed in the next major release."
    required: false
  apikey:
    description: 'DEPRECATED: use api-key instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'api-key' instead. Will be removed in the next major release."
    required: false
  projectname:
    description: 'DEPRECATED: use project-name instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'project-name' instead. Will be removed in the next major release."
    required: false
  projectversion:
    description: 'DEPRECATED: use project-version instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'project-version' instead. Will be removed in the next major release."
    required: false
  projecttags:
    description: 'DEPRECATED: use project-tags instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'project-tags' instead. Will be removed in the next major release."
    required: false
  autocreate:
    description: 'DEPRECATED: use auto-create instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'auto-create' instead. Will be removed in the next major release."
    required: false
  bomfilename:
    description: 'DEPRECATED: use bom-filename instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'bom-filename' instead. Will be removed in the next major release."
    required: false
  parentname:
    description: 'DEPRECATED: use parent-name instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'parent-name' instead. Will be removed in the next major release."
    required: false
  parentversion:
    description: 'DEPRECATED: use parent-version instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'parent-version' instead. Will be removed in the next major release."
    required: false
  isLatest:
    description: 'DEPRECATED: use is-latest instead. Will be removed in the next major release.'
    deprecationMessage: "Use 'is-latest' instead. Will be removed in the next major release."
    required: false
outputs:
  token:
    description: 'The token response from Dependency-Track after SBOM file upload'
  project-uuid:
    description: 'The UUID of the project the BOM was uploaded to (available in DT v5.0.0 and later)'
  projectUuid:
    description: 'DEPRECATED: use project-uuid instead. Will be removed in the next major release.'
runs:
  using: 'node24'
  main: 'dist/index.js'