clickhouse/ClickBOM
Download SBOMs from GitHub, Mend, Wiz, and Trivy. Convert to CycloneDX and SPDX formats. Upload to S3 and ClickHouse.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token for API access | no | — |
| repository | Repository to download SBOM from (format: owner/repo) | no | — |
| mend-email | Mend user email address | no | — |
| mend-org-uuid | Mend organization UUID for authentication | no | — |
| mend-user-key | Mend user key for authentication | no | — |
| mend-base-url | Mend base URL (e.g., https://api-saas.mend.io) | no | https://api-saas.mend.io |
| mend-product-uuid | Mend product UUID for product-scoped SBOM | no | — |
| mend-project-uuid | Mend project UUID for project-scoped SBOM | no | — |
| mend-org-scope-uuid | Mend organization UUID for organization-scoped SBOM (different from auth org UUID) | no | — |
| mend-project-uuids | Comma-separated list of specific project UUIDs to include | no | — |
| mend-max-wait-time | Maximum time to wait for Mend report generation (seconds) | no | 1800 |
| mend-poll-interval | Polling interval for Mend report status (seconds) | no | 30 |
| wiz-auth-endpoint | Wiz authentication endpoint | no | — |
| wiz-api-endpoint | Wiz API endpoint | no | — |
| wiz-client-id | Wiz API client ID | no | — |
| wiz-client-secret | Wiz API client secret | no | — |
| wiz-report-id | Wiz report ID to download | no | — |
| trivy-image | Container image to scan with Trivy for SBOM generation (format: registry/repo:tag or ECR URI) | no | — |
| trivy-ecr-account-id | AWS Account ID where ECR repository is located (for cross-account access) | no | — |
| trivy-ecr-region | AWS region where ECR repository is located | no | us-east-1 |
| trivy-ecr-role-arn | IAM role ARN to assume for ECR access (for cross-account) | no | — |
| trivy-format | Trivy SBOM output format: cyclonedx or spdxjson | no | cyclonedx |
| aws-access-key-id | DEPRECATED — prefer OIDC via aws-actions/configure-aws-credentials. Static AWS access key; exported as AWS_ACCESS_KEY_ID for the SDK default credential chain. | no | — |
| aws-secret-access-key | DEPRECATED — prefer OIDC via aws-actions/configure-aws-credentials. Static AWS secret access key; exported as AWS_SECRET_ACCESS_KEY for the SDK default credential chain. | no | — |
| aws-region | DEPRECATED — prefer OIDC via aws-actions/configure-aws-credentials. AWS region; exported as AWS_DEFAULT_REGION. | no | us-east-1 |
| s3-bucket | S3 bucket name | yes | — |
| s3-key | S3 object key/path | no | sbom.json |
| clickhouse-url | ClickHouse URL for storing SBOM components data | no | — |
| clickhouse-database | ClickHouse database name | no | default |
| clickhouse-username | ClickHouse username | no | default |
| clickhouse-password | ClickHouse password | no | "" |
| truncate-table | Truncate ClickHouse table before inserting new data | no | false |
| sbom-source | SBOM source: github, mend, wiz, or trivy | no | github |
| sbom-format | Final SBOM format (spdxjson or cyclonedx) | no | cyclonedx |
| merge | Merge SBOM files from S3 into one | no | false |
| include | Comma-separated list of filenames or patterns to include when merging (only used with merge=true) | no | "" |
| exclude | Comma-separated list of filenames or patterns to exclude when merging (only used with merge=true) | no | "" |
| debug | Enable debug logging | no | false |
Outputs
no outputs