search

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
6.05k stars 557 forks source link

Show dependencies for Github Actions #2953

Open yaabdala opened 3 months ago

yaabdala commented 3 months ago

Summary

I would like to submit a feature request for showing dependencies of Github Actions

Current behavior

syft has no problem finding github actions and showing them as dependencies to a project when you run syft on a git repo directory that uses Github Actions. However, the dependencies of those actions are not listed. We have to download the release archive of the github action and run syft on that to get some visibility.

Steps to reproduce

  1. Checkout a repository that uses Github Actions
  2. Run syft on the directory
  3. Observe that Github Actions are a part of the resulting SBOM, however the dependencies for those actions are not listed.

Requested behavior

Have dependencies for github actions be listed in SBOM so that vulnerable packages used by an Action can be flagged by grype