Skip to content

Commit 8908971

Browse files
stacknilstacknil
authored
[codex] Add policy JSON Actions consumer example
1 parent 7c42ba4 commit 8908971

4 files changed

Lines changed: 129 additions & 0 deletions

File tree

‎tools/sbom-diff-and-risk/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,7 @@ The [examples/](examples/) directory includes:
308308
- a sample pass JSON report at [sample-report.json](examples/sample-report.json)
309309
- a sample summary-only JSON artifact at [sample-summary.json](examples/sample-summary.json)
310310
- a consumer GitHub Actions workflow example at [github-actions-consumer.yml](examples/github-actions-consumer.yml)
311+
- a policy-gated consumer GitHub Actions workflow example at [github-actions-policy-consumer.yml](examples/github-actions-policy-consumer.yml)
311312
- a sample pass Markdown report at [sample-report.md](examples/sample-report.md)
312313
- sample policy-warn reports at [sample-policy-warn-report.json](examples/sample-policy-warn-report.json) and [sample-policy-warn-report.md](examples/sample-policy-warn-report.md)
313314
- sample policy-fail reports at [sample-policy-fail-report.json](examples/sample-policy-fail-report.json) and [sample-policy-fail-report.md](examples/sample-policy-fail-report.md)

‎tools/sbom-diff-and-risk/docs/github-actions-consumer-example.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ The same workflow is also checked in as
2222
[../examples/github-actions-consumer.yml](../examples/github-actions-consumer.yml)
2323
for copying into consumer repositories.
2424

25+
For a policy-gated variant that writes `outputs/policy.json` with
26+
`--policy-json PATH`, see
27+
[../examples/github-actions-policy-consumer.yml](../examples/github-actions-policy-consumer.yml).
28+
2529
```yaml
2630
name: Dependency diff review
2731

@@ -143,3 +147,5 @@ from that local checkout instead of downloading a release wheel:
143147

144148
For compact summary consumption patterns, see
145149
[summary-json-ci-cookbook.md](summary-json-ci-cookbook.md).
150+
For policy sidecar consumption patterns, see
151+
[policy-decision-ci-cookbook.md](policy-decision-ci-cookbook.md).

‎tools/sbom-diff-and-risk/docs/policy-decision-ci-cookbook.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ decision metadata remains available for review.
2525
For a checked-in reference artifact generated from this path, see
2626
[sample-policy.json](../examples/sample-policy.json).
2727

28+
For a full GitHub Actions consumer workflow example that captures
29+
`outputs/policy.json`, uploads it even when local policy fails, and then fails
30+
the job based on `summary.policy`, see
31+
[github-actions-policy-consumer.yml](../examples/github-actions-policy-consumer.yml).
32+
2833
## Python consumer
2934

3035
This example reads the policy-only JSON sidecar, prints compact policy status,

‎tools/sbom-diff-and-risk/examples/github-actions-policy-consumer.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# Example only.
2+
# Copy this file into a consumer repository under .github/workflows/ if useful.
3+
# This repository does not run this file as a workflow.
4+
# Production PyPI publishing for sbom-diff-and-risk is intentionally deferred;
5+
# install from a GitHub Release asset or local checkout instead.
6+
7+
name: Dependency policy review
8+
9+
on:
10+
pull_request:
11+
workflow_dispatch:
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
dependency-policy:
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Check out consumer repository
22+
uses: actions/checkout@v6
23+
24+
- name: Set up Python
25+
uses: actions/setup-python@v6
26+
with:
27+
python-version: "3.x"
28+
29+
- name: Download sbom-diff-and-risk release wheel
30+
env:
31+
GH_TOKEN: ${{ github.token }}
32+
run: |
33+
mkdir -p .tooling/sbom-diff-risk
34+
gh release download v0.8.0 \
35+
--repo stacknil/scientific-computing-toolkit \
36+
--pattern "sbom_diff_and_risk-0.8.0-py3-none-any.whl" \
37+
--dir .tooling/sbom-diff-risk
38+
39+
- name: Install sbom-diff-risk
40+
run: |
41+
python -m pip install \
42+
.tooling/sbom-diff-risk/sbom_diff_and_risk-0.8.0-py3-none-any.whl
43+
44+
- name: Compare dependency evidence with local policy
45+
id: compare
46+
run: |
47+
mkdir -p outputs
48+
set +e
49+
sbom-diff-risk compare \
50+
--before path/to/before-sbom.json \
51+
--after path/to/after-sbom.json \
52+
--format auto \
53+
--policy path/to/policy.yml \
54+
--out-json outputs/report.json \
55+
--out-md outputs/report.md \
56+
--policy-json outputs/policy.json \
57+
--out-sarif outputs/report.sarif
58+
status=$?
59+
set -e
60+
echo "$status" > outputs/policy-exit-code.txt
61+
echo "exit_code=$status" >> "$GITHUB_OUTPUT"
62+
63+
- name: Summarize local policy decision
64+
run: |
65+
python - <<'PY'
66+
import json
67+
from pathlib import Path
68+
69+
policy_report = json.loads(
70+
Path("outputs/policy.json").read_text(encoding="utf-8")
71+
)
72+
policy = policy_report.get("summary", {}).get("policy")
73+
74+
if policy is None:
75+
print("policy=not-used")
76+
raise SystemExit(0)
77+
78+
print(
79+
"policy="
80+
f"{policy['status']} "
81+
f"blocking={policy['blocking']} "
82+
f"warning={policy['warning']} "
83+
f"suppressed={policy['suppressed']}"
84+
)
85+
86+
findings = (
87+
policy_report.get("blocking_findings", [])
88+
+ policy_report.get("warning_findings", [])
89+
+ policy_report.get("suppressed_findings", [])
90+
)
91+
92+
for finding in findings:
93+
print(
94+
"policy-finding "
95+
f"level={finding.get('level')} "
96+
f"rule={finding.get('policy_rule')} "
97+
f"reason={finding.get('decision_reason')} "
98+
f"severity_source={finding.get('severity_source')} "
99+
f"observed={finding.get('observed_value')} "
100+
f"threshold={finding.get('matched_threshold')}"
101+
)
102+
103+
if policy["status"] == "fail":
104+
raise SystemExit("local policy failed")
105+
PY
106+
107+
- name: Upload dependency policy outputs
108+
if: always()
109+
uses: actions/upload-artifact@v7
110+
with:
111+
name: dependency-policy-outputs
112+
path: |
113+
outputs/report.json
114+
outputs/report.md
115+
outputs/policy.json
116+
outputs/policy-exit-code.txt
117+
outputs/report.sarif

0 commit comments

Comments
 (0)