Repository navigation
Add NowSecure Mobile SBOM workflow #11
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
| # | ||
| # NowSecure: The Mobile Security Experts <https://www.nowsecure.com/>. | ||
| # | ||
| # To use this workflow, you must have a token for NowSecure Platform. If you are a NowSecure customer, | ||
| # you can find it in NowSecure Platform. | ||
| # | ||
| # If you *are not* a NowSecure customer, click here to sign up for a free trial to get access: | ||
| # <https://bit.ly/ns-git-sbom>. | ||
| # | ||
| # Instructions: | ||
| # | ||
| # 1. In the settings for your repository, click "Secrets" then "New repository secret". Name the secret "NS_TOKEN" and | ||
| # paste in your Platform token. If you do not have a Platform token, or wish to create a new one for GitHub, visit | ||
| # NowSecure Platform and go to "Profile & Preferences" then create a token labelled "GitHub". | ||
| # | ||
| # 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository | ||
| # and review the "Dependency graph" tab in the "Insights" pane once the action has run. | ||
|
|
||
| name: "NowSecure Mobile SBOM" | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| # The branches below must be a subset of the branches above | ||
| branches: [ "main" ] | ||
| schedule: | ||
| - cron: '40 16 * * 0' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| nowsecure: | ||
| name: NowSecure Mobile SBOM | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
There was a problem hiding this comment.
Once a valid mobile build is configured, the pinned action enables dependency submission, which posts a snapshot to GitHub's dependency graph; that endpoint requires Useful? React with 👍 / 👎. |
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Build your application | ||
| run: ./gradlew assembleDebug # Update this to build your Android or iOS application | ||
|
There was a problem hiding this comment.
For every configured trigger, this command runs in the checked-out repository, but there is no Useful? React with 👍 / 👎. |
||
|
|
||
| - name: NowSecure upload app | ||
| uses: nowsecure/nowsecure-sbom-action@ecb731b6f17a83fa53f756f9dae2ec7034c5ed7c | ||
| with: | ||
| token: ${{ secrets.NS_TOKEN }} | ||
| app_file: app-debug.apk # Update this to a path to your .ipa or .apk | ||
| group_id: {{ groupId }} # Update this to your desired Platform group ID | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For pull requests from forks, GitHub withholds repository secrets from
pull_requestworkflows and evaluates unavailable secret expressions as empty strings (GitHub documentation). The pinned action requires itstokeninput, soNS_TOKENis empty and the NowSecure operation will fail for every fork-originated PR even after the build configuration is corrected. Restrict the upload job to trusted events or make this scan nonblocking for fork PRs.Useful? React with 👍 / 👎.