Add support for GitHub Actions about syft HOT 6 CLOSED

Yeah, that's right. They will be cataloged in the SBOM but as far as I know there aren't any current sources of vulnerability data for them.

from syft.

Hey @aerabi, take a look at https://github.com/anchore/sbom-action/ -- this is our Action designed for calling Syft and generating SBOMs as part of a CI pipeline. Hope this helps!

from syft.

Thanks for your comment, @tgerla! This GitHub action that you just mentioned might have vulnerabilities, as can the Docker build action, etc. Can we generate an SBOM for a GitHub workflow to include the dependencies of the actions used in them?

from syft.

Oh, I'm sorry, I misunderstood your request. We actually do have a cataloger for scanning GitHub actions: #2140 -- I'm not sure if those catalogers are enabled by default so you may need to enable it specifically: https://github.com/anchore/syft/?tab=readme-ov-file#package-cataloger-selection

from syft.

Awesome, thanks for mentioning the PR.

I believe that's all Syft can support the matter with. As mentioned in the issue (#1896), the Actions recorded using the cataloger won't be matched to any CVEs, as no one has a database for CVEs in GitHub Actions (right?).

from syft.

I'll go ahead and close this issue because I don't think there is any action to take--but please let me know if you need anything else!

from syft.