Generates daily SBOM (using syft) and vulnerability reports (using grype) for local list of images (images), and N number of most popular community images on Docker Hub. The resulting files are saved to GCS bucket, and data is imported into BigQuery tables. GCP authentication implemented using OIDC.

To setup your own instance of sbomer first, fork this repo and clone it locally. Next, deploy the service account, GCS bucket, and OIDC provider to your GCP project:

make setup

When prompted, provide the two required parameters:

• project_id - the ID of your GCP project (e.g. your-project-id)
• git_repo - the name of your forked github repo (e.g. your-github-username/your-repo-name)

The defaults for optional parameters are defined in setup/variables.tf.

The output will include the parameters you will need to update in .github/workflows/process.yaml. Find the auth_provider, auth_account, and target_bucket environment variables and update them with the PROVIDER, ACCOUNT, and BUCKET using values provided from the setup respectively:

env:
  auth_provider: "<PROVIDER>"
  auth_account: "<ACCOUNT>"
  target_bucket: "<BUCKET>"

The workflow is currently set to execute multiple times a day. If you want change that, alter the schedule at the top of .github/workflows/list.yaml.

on:
  schedule:
    - cron: '0 */5 * * *'

To test, simply commit your changes and push upstream. In addition to the above described schedule, the workflow will also execute on each main branch push or PR.

You can also execute the process workflow manually for any publicly accessible container image using either GitHub CLI (gh) or curl. For example, to generate SBOM and vulnerability report for the redis image using either of these options:

Instructions on how to install GitHub CLI are located here.

gh workflow run .github/workflows/process.yaml -f image="redis"

curl \
  -X POST \
  -H "Accept: application/vnd.github.v3+json" \
  -H "Authorization: token $GITHUB_ACCESS_TOKEN" \
  https://api.github.com/repos/$ORG/$REPO/actions/workflows/process.yaml/dispatches \
  -d '{"ref":"main", "inputs": { "image":"redis" }}'

The data from SBOM and vulnerability report for each image is saved into two tables in BigQuery:

The setup/schema/pkg.json file containers complete schema used to create pkg table.

The setup/schema/vul.json file containers complete schema used to create vul table.

To delete all the resources created by Terraform in your GCP project:

make destroy

This is my personal project and it does not represent my employer. While I do my best to ensure that everything works, I take no responsibility for issues caused by this code.