Skip to content

Commit 6a2a4e9

Browse files
committed
Update readme
1 parent d967f28 commit 6a2a4e9

File tree

1 file changed

+10
-27
lines changed

1 file changed

+10
-27
lines changed

README.md

Lines changed: 10 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,23 @@
1-
# SPDX to Dependency Graph Action
1+
# Conda dependency submission action
22

3-
This repository makes it easy to upload an SPDX SBOM to GitHub's dependency submission API. This lets you quickly receive Dependabot alerts for package manifests which GitHub doesn't directly support like pnpm or Paket by using existing off-the-shelf SBOM generators.
3+
This repository scans Conda environment.yaml files and uploads the results to the dependency graph. While GitHub does not support alerting on OS-level dependencies, it will alert on any PyPI dependencies that are defined in the environment.yaml.
44

55

66
### Example workflow
7-
This workflow uses the [Microsoft sbom-tool](https://github.com/microsoft/sbom-tool).
7+
88
```yaml
99

10-
name: SBOM upload
10+
name: Conda dependency submission
1111

12-
on:
12+
on:
1313
workflow_dispatch:
14-
push:
15-
branches: ["main"]
14+
push:
1615

1716
jobs:
18-
SBOM-upload:
19-
17+
dependency-submission:
2018
runs-on: ubuntu-latest
21-
permissions:
22-
id-token: write
23-
contents: write
24-
2519
steps:
26-
- uses: actions/checkout@v3
27-
- name: Generate SBOM
28-
run: |
29-
curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
30-
chmod +x $RUNNER_TEMP/sbom-tool
31-
$RUNNER_TEMP/sbom-tool generate -b . -bc . -pn ${{ github.repository }} -pv 1.0.0 -ps OwnerName -nsb https://sbom.mycompany.com -V Verbose
32-
- uses: actions/upload-artifact@v3
33-
with:
34-
name: sbom
35-
path: _manifest/spdx_2.2
36-
- name: SBOM upload
37-
uses: jhutchings1/spdx-to-dependency-graph-action@v0.0.1
38-
with:
39-
filePath: "_manifest/spdx_2.2/"
20+
- uses: actions/checkout@v3
21+
- name: Conda dependency scanning
22+
uses: jhutchings1/conda-dependency-submission-action@v0.0.1
4023
```

0 commit comments

Comments
 (0)