zien-tf/Z-BOM SBOM Checker
Submit source to your on-premises Z-BOM service for SBOM/CVE analysis and report results on the PR.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| url | Z-BOM server URL (e.g. http://z-bom:8000) | yes | — |
| web-url | Z-BOM web UI base for the report link (defaults to url) | no | "" |
| token | Z-BOM CI token (store as the Z_BOM_TOKEN secret) | yes | — |
| type | Scan type: code | firmware | no | code |
| path | Source path to archive (git-tracked files under this path) | no | . |
| wait | Wait for the scan to finish and report results | no | true |
| timeout | Max seconds to wait for completion | no | 1800 |
| poll-interval | Seconds between status polls | no | 10 |
| fail-on | Fail the job if a CVE of this severity or higher is found: critical | high | medium | low | none | no | none |
| comment | Upsert a PR comment with the result | no | true |
| github-token | Token used to post the PR comment | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| run-id | Z-BOM analysis run id |
| status | Final run status (COMPLETED | FAILED | ...) |
| total-cve | Number of CVEs needing response |
| result-json | Full result summary JSON |