andrewmusselman commented on issue #1595:
URL:
https://github.com/apache/tooling-trusted-releases/issues/1595#issuecomment-5704885313
@dave2wave @alitheg Two repos use anchore/sbom-action, both pinned to the
same SHA. Nifi uses format: spdx-json (the default SPDX output).
tooling-trusted-releases uses format: cyclonedx-json (ATR-compatible). Per
Alitheg's comment, ATR supports CycloneDX JSON and XML but not SPDX — any
project adopting this action should set format: cyclonedx-json for ATR
compatibility.
Let me know if this answers your questions.
# Action Usage: anchore/sbom-action — apache
Scanned 4729 workflows across 2499 repos.
**2** usages across **2** repos.
## Versions
| Version | Count |
|---------|-------|
| `e22c389904149dbc22b58101806040fa8d37a610` | 2 |
## Configuration Summary
**artifact-name:**
- `nifi-${{ env.PROJECT_VERSION }}.spdx.json` (1 workflows)
**file:**
- `nifi-assembly/target/nifi-${{ env.PROJECT_VERSION }}-bin.zip` (1
workflows)
**format:**
- `spdx-json` (1 workflows)
- `cyclonedx-json` (1 workflows)
**image:**
- `tooling-trusted-release:latest` (1 workflows)
**output-file:**
- `nifi-${{ env.PROJECT_VERSION }}.spdx.json` (1 workflows)
- `atr.cdx.json` (1 workflows)
**path:**
- `''` (1 workflows)
## By Repository
| PMC | Repo | Workflow | Version | Key Config |
|-----|------|----------|---------|------------|
| nifi | nifi |
[code-compliance.yml](https://github.com/apache/nifi/blob/HEAD/.github/workflows/code-compliance.yml)
| `e22c389904149dbc22b58101806040fa8d37a610` | artifact-name=nifi-${{
env.PROJECT_VERSION }}.spdx.json, file=nifi-assembly/target/nifi-${{
env.PROJECT_VERSION }}-bin.zip, format=spdx-json, output-file=nifi-${{
env.PROJECT_VERSION }}.spdx.json, path='' |
| tooling | tooling-trusted-releases |
[generatesbom.yml](https://github.com/apache/tooling-trusted-releases/blob/HEAD/.github/workflows/generatesbom.yml)
| `e22c389904149dbc22b58101806040fa8d37a610` | format=cyclonedx-json,
image=tooling-trusted-release:latest, output-file=atr.cdx.json |
---
*Scanned 4729 workflows. 2 usages found.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
