This action needs to be added at step level in a job to upload a SBOM document to a ServiceNow instance.
Product Links
- ServiceNow Vulnerability Response
- Vulnerability Response technical documentation
This action facilitates uploading a SBOM document to the SBOM Workspace. Configuring the action input parameter's provider
, repository
, and path
values determines which SBOM document the action will upload.
-
The Vulnerability Response application must already be installed on the provided ServiceNow instance
-
The following repository secrets must be set:
Secret Name Example Description SN_INSTANCE_URL
https://instance.service-now.com/
The URL of the ServiceNow instance with an accessible SBOM Workspace. Ensure the URL has the scheme ( https
), subdomain (instance
), domain (service-now
), and top-level domain (com
) for your instance.SN_SBOM_USER
username
The username used to log into the ServiceNow instance. SN_SBOM_PASSWORD
password
The password used to log into the ServiceNow instance. GH_TOKEN
gh_78dajnkrffj2806fuz7578o
A GitHub token used to access the repository that is storing the SBOM document. The
GH_TOKEN
must be generated with therepo
scope.GitHub repository secrets documentation.
The action may be launched from any supported GitHub Action trigger. The example below is sensitive to push
events.
on: [push]
jobs:
sbom-upload:
runs-on: ubuntu-latest
name: SBOM Workspace Upload
steps:
- name: Upload
id: upload
uses: ServiceNow/vulnerability-response@<RELEASE TAG>
with:
sn-sbom-user: ${{ secrets.SN_SBOM_USERNAME }}
sn-sbom-password: ${{ secrets.SN_SBOM_PASSWORD }}
sn-instance-url: ${{ secrets.SN_INSTANCE_URL }}
gh-token: ${{ secrets.GH_TOKEN }}
gh-account-owner: <REPOSITORY OWNER>
repository: <REPOSITORY NAME>
provider: 'repository'
path: 'sboms/sample_sbom.txt'
Non-Optional, Public Inputs: Configuration
These inputs configure the behavior of the action.
Input Name | Example | Description |
---|---|---|
gh-account-owner |
github-account |
The account that owns the target repository. |
repository |
github-repository |
The name of the repository that holds the target SBOMs. |
provider |
repository |
The value repository must be supplied here. |
path |
sboms/sample_sbom.json |
The absolute path within the provided repository to the SBOM document. |
Optional, Public Inputs: API Parameters
These inputs are passed as search parameters to underlying SBOM Workspace
upload
endpoint. Refer to API documentation for further details.
Input Name | Type | Description |
---|---|---|
business-application-id |
<Sys ID> |
SYS ID of the business application to map with the root application of given SBOM. |
business-application-name |
String |
Name of business application to map with the root application of given SBOM. |
build-id |
String |
Build ID of the SBOM build. |
product-model-id |
<Sys ID> |
SYS ID of product model to map with the root application of given SBOM. |
requested-by |
Boolean |
Determines if devops workflow is executed. |
lifecycle-stage |
production | pre_production |
Life cycle stage of the entity (i.e., production, pre_production). |
fetch-vulnerability-info |
Boolean |
Flag to run the vulnerability intelligence integration. |
fetch-package-info |
Boolean |
Flag to run the package intelligence integration. |
Non-Optional, Secret Inputs
Secret Name | Example | Description |
---|---|---|
sn-sbom-user |
username |
The username used to authenticate into the instance that has SBOM Workspace installed. |
sn-sbom-password |
password |
The password used to authenticate into the instance that has SBOM Workspace installed. |
sn-instance-url |
https://instance.service-now.com/ |
The URL of the ServiceNow instance that has SBOM Workspace installed. |
gh-token |
gh_78dajnkrffj2806fuz7578o |
A GitHub token used to access the repository that is storing the SBOM document. |
Annotated Fields
uses
: Points to the ServiceNow SBOM Upload GitHub Action. Replace<RELEASE TAG>
with the appropriate version of the Action.gh-account-owner
: The account name that owns the target repository. Replace<REPOSITORY OWNER>
with the appropriate account owner string. It can be found within the URL of the calling repository.repository
: The repository name that holds the target SBOM document. Replace<REPOSITORY NAME>
with the appropriate repository string. It can be found within the URL of the calling repository.
On successful upload, the following output is display, indicating the SBOM has been uploaded and is enqueued for processing:
{
result: {
status: 'success',
message: 'Queued for processing.',
bomRecordId: 'abc123xyzabc123xyzabc123xyzabc123'
}
}