Upload from GitHub Actions

From GitHub ActionsCopy Anchor Link

The Prodgator report action can attach a scanner's output file to a scan or sbom attestation. When that file is SARIF, CycloneDX or SPDX JSON and uploads with the report, Prodgator reads it into findings as well, with no API key. Set up a scanner has an example for each common scanner:

permissions:
  id-token: write

steps:
  - run: trivy fs --format sarif --output trivy-results.sarif .
  - uses: prodgator/prodgator-action@v1
    if: always()
    with:
      attestations: |
        [{ "kind": "scan", "name": "trivy", "file": "trivy-results.sarif", "format": "sarif", "data": { "tool": "trivy", "failOn": "high" } }]

• The attestation's name becomes the upload's category (characters outside the category alphabet become -).
• The repository, ref and commit come from the run's GitHub OIDC token.
• data.mode is optional: full (default) or diff. A diff scan looks only at changed code, so Prodgator never uses it to close findings or to confirm or clear findings carried over from pull requests. Any other value is ignored with a warning.
• Reports from a fork, pull_request_target or workflow_run are marked untrusted. Their scan results are kept in the Scan results view but never open findings.
• These uploads count against the run's limit, not the hourly limit. A report over the limit is still stored as a run report; only its findings are skipped.
• The action also accepts "format": "grype-json" and "format": "trivy-json" for compatibility. Those files are attached to the run report, but Prodgator reads no findings from them. Use "format": "sarif".

Scan the tracked branch tooCopy Anchor Link

Run the same step on pushes to your tracked branch and on a schedule, as well as on pull requests. Findings from a merged pull request wait for a scan of the tracked branch to confirm or clear them. See Findings from pull requests for a workflow.

Several scanners in one stepCopy Anchor Link

One action step can send several files. Put every attestation in the same array:

      - uses: prodgator/prodgator-action@v1
        if: always()
        with:
          attestations: |
            [
              { "kind": "scan", "name": "grype", "file": "grype.sarif", "format": "sarif", "data": { "tool": "grype" } },
              { "kind": "scan", "name": "semgrep", "file": "semgrep.sarif", "format": "sarif", "data": { "tool": "semgrep" } }
            ]