[FEATURE] Added support of workflow artifact's retention policy (#398)

Signed-off-by: Viacheslav Kudinov <viacheslav@kudinov.tech>
anchore · Mar 20, 2023 · 448520c · 448520c
1 parent 8a5a132
commit 448520c
Show file tree

Hide file tree

Showing 11 changed files with 120 additions and 43 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -31,7 +31,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: Vampire/setup-wsl@v1
+      - uses: Vampire/setup-wsl@v2
         if: ${{ matrix.os == 'windows-latest' }}
         with:
           distribution: Alpine
@@ -117,3 +117,13 @@ jobs:
       - uses: ./publish-sbom # anchore/sbom-action/publish-sbom
         with:
           sbom-artifact-match: "^dont-match-anything$"
+
+      - uses: ./ # anchore/sbom-action with artifact retention
+        name: "One day artifact retention test"
+        id: one-day
+        with:
+          image: alpine:latest
+          upload-artifact-retention: 1
+          artifact-name: one-day.sbom.spdx
+          output-file: one-day-sbom.spdx
+          format: spdx
diff --git a/README.md b/README.md
@@ -123,17 +123,22 @@ use the `artifact-name` parameter:
 The main [SBOM action](action.yml), responsible for generating SBOMs
 and uploading them as workflow artifacts and release assets.
 
-| Parameter             | Description                                                                                                                                             | Default                          |
-| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
-| `path`                | A path on the filesystem to scan. This is mutually exclusive to `file` and `image`.                                                                     | \<current directory>             |
-| `file`                | A file on the filesystem to scan. This is mutually exclusive to `path` and `image`.                                                                     |                                  |
-| `image`               | A container image to scan. This is mutually exclusive to `path` and `file`. See [Scan a container image](#scan-a-container-image) for more information. |                                  |
-| `registry-username`   | The registry username to use when authenticating to an external registry                                                                                |                                  |
-| `registry-password`   | The registry password to use when authenticating to an external registry                                                                                |                                  |
-| `artifact-name`       | The name to use for the generated SBOM artifact. See: [Naming the SBOM output](#naming-the-sbom-output)                                                 | `sbom-<job>-<step-id>.spdx.json` |
-| `output-file`         | The location to output a resulting SBOM                                                                                                                 |                                  |
-| `format`              | The SBOM format to export. One of: `spdx`, `spdx-json`, `cyclonedx`, `cyclonedx-json`                                                                   | `spdx-json`                      |
-| `dependency-snapshot` | Whether to upload the SBOM to the GitHub Dependency submission API                                                                                      | `false`                          |
+| Parameter                   | Description                                                                                                                                             | Default                          |
+| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
+| `path`                      | A path on the filesystem to scan. This is mutually exclusive to `file` and `image`.                                                                     | \<current directory>             |
+| `file`                      | A file on the filesystem to scan. This is mutually exclusive to `path` and `image`.                                                                     |                                  |
+| `image`                     | A container image to scan. This is mutually exclusive to `path` and `file`. See [Scan a container image](#scan-a-container-image) for more information. |                                  |
+| `registry-username`         | The registry username to use when authenticating to an external registry                                                                                |                                  |
+| `registry-password`         | The registry password to use when authenticating to an external registry                                                                                |                                  |
+| `artifact-name`             | The name to use for the generated SBOM artifact. See: [Naming the SBOM output](#naming-the-sbom-output)                                                 | `sbom-<job>-<step-id>.spdx.json` |
+| `output-file`               | The location to output a resulting SBOM                                                                                                                 |                                  |
+| `format`                    | The SBOM format to export. One of: `spdx`, `spdx-json`, `cyclonedx`, `cyclonedx-json`                                                                   | `spdx-json`                      |
+| `dependency-snapshot`       | Whether to upload the SBOM to the GitHub Dependency submission API                                                                                      | `false`                          |
+| `upload-artifact`           | Upload artifact to workflow                                                                                                                             | `true`                           |
+| `upload-artifact-retention` | Retention policy in days for uploaded artifact to workflow.                                                                                             |                                  |
+| `upload-release-assets`     | Upload release assets                                                                                                                                   | `true`                           |
+| `syft-version`              | The version of Syft to use                                                                                                                              |                                  |
+| `github-token`              | Authorized secret GitHub Personal Access Token.                                                                                                         | `github.token`                   |
 
 ### anchore/sbom-action/publish-sbom
 
@@ -167,7 +172,7 @@ required to set up a WSL distribution prior to invoking the `sbom-action`, for
 example, you can add the small Alpine image:
 
 ```yaml
-- uses: Vampire/setup-wsl@v1
+- uses: Vampire/setup-wsl@v2
   with:
     distribution: Alpine
 ```

diff --git a/action.yml b/action.yml
@@ -58,6 +58,16 @@ inputs:
     description: "Upload artifact to workflow"
     default: "true"
 
+  upload-artifact-retention:
+    required: false
+    description: >
+      Retention policy for uploaded artifact to workflow.
+
+      Minimum 1 day.
+      Maximum 90 days unless changed from the repository settings page.
+      An input of 0 assumes default retention value.
+    default: 0
+
   upload-release-assets:
     required: false
     description: "Upload release assets"

diff --git a/dist/attachReleaseAssets/index.js b/dist/attachReleaseAssets/index.js
diff --git a/dist/downloadSyft/index.js b/dist/downloadSyft/index.js
diff --git a/dist/runSyftAction/index.js b/dist/runSyftAction/index.js
diff --git a/package-lock.json b/package-lock.json
diff --git a/src/github/GithubClient.ts b/src/github/GithubClient.ts
@@ -1,4 +1,7 @@
-import { create as createArtifactClient } from "@actions/artifact";
+import {
+  create as createArtifactClient,
+  UploadOptions,
+} from "@actions/artifact";
 import { DownloadHttpClient } from "@actions/artifact/lib/internal/download-http-client";
 import * as core from "@actions/core";
 import * as github from "@actions/github";
@@ -177,13 +180,16 @@ export class GithubClient {
    * Uploads a workflow artifact for the current workflow run
    * @param name name of the artifact
    * @param file file to upload
+   * @param retention retention days of a artifact
    */
   async uploadWorkflowArtifact({
     name,
     file,
+    retention,
   }: {
     name: string;
     file: string;
+    retention?: number;
   }): Promise<void> {
     const rootDirectory = path.dirname(file);
     const client = createArtifactClient();
@@ -192,14 +198,20 @@ export class GithubClient {
       "uploadArtifact:",
       name,
       file,
+      retention,
       rootDirectory,
       core.isDebug() && fs.readdirSync(rootDirectory)
     );
 
+    const options: UploadOptions = {
+      continueOnError: false,
+    };
+    if (retention) {
+      options.retentionDays = retention;
+    }
+
     const info = await suppressOutput(async () =>
-      client.uploadArtifact(name, [file], rootDirectory, {
-        continueOnError: false,
-      })
+      client.uploadArtifact(name, [file], rootDirectory, options)
     );
 
     debugLog("uploadArtifact response:", info);

diff --git a/src/github/SyftGithubAction.ts b/src/github/SyftGithubAction.ts
@@ -280,6 +280,8 @@ export async function uploadSbomArtifact(contents: string): Promise<void> {
   const filePath = `${tempDir}/${fileName}`;
   fs.writeFileSync(filePath, contents);
 
+  const retentionDays = parseInt(core.getInput("upload-artifact-retention"));
+
   const outputFile = core.getInput("output-file");
   if (outputFile) {
     fs.copyFileSync(filePath, outputFile);
@@ -291,6 +293,7 @@ export async function uploadSbomArtifact(contents: string): Promise<void> {
   await client.uploadWorkflowArtifact({
     file: filePath,
     name: fileName,
+    retention: retentionDays,
   });
 }
 

diff --git a/tests/SyftGithubAction.test.ts b/tests/SyftGithubAction.test.ts
@@ -123,7 +123,7 @@ describe("Action", () => {
 
     await action.runSyftAction();
 
-    expect(fs.existsSync(inputs["output-file"])).toBeTruthy();
+    expect(fs.existsSync(inputs["output-file"] as string)).toBeTruthy();
 
     await action.attachReleaseAssets();
 
@@ -133,6 +133,26 @@ describe("Action", () => {
     expect(fs.existsSync(outputFile)).toBeTruthy();
   });
 
+  it("runs with retention input", async () => {
+    setData({
+      inputs: {
+        image: "org/img",
+        "upload-artifact": "true",
+        "upload-artifact-retention": "3",
+      },
+    });
+
+    await action.runSyftAction();
+
+    const { artifacts } = data;
+
+    expect(artifacts).toHaveLength(1);
+
+    const opts = (artifacts[0] as any).options
+
+    expect(opts.retentionDays).toEqual(3)
+  });
+
   it("runs without uploading anything", async () => {
     setData({
       inputs: {

diff --git a/tests/mocks.ts b/tests/mocks.ts
@@ -9,7 +9,7 @@ export function getMocks() {
 
     workflowRuns: Partial<WorkflowRun>[] = [];
 
-    inputs: { [key: string]: string } = {};
+    inputs: { [key: string]: string | number } = {};
 
     outputs: { [key: string]: string } = {};
 
@@ -125,10 +125,12 @@ export function getMocks() {
         return {
           create() {
             return {
-              uploadArtifact(name: string, file: string) {
+              uploadArtifact(name: string, file: string, rootDirectory: string, options?: any) {
                 data.artifacts.push({
                   name: path.basename(name),
                   file,
+                  rootDirectory,
+                  options,
                 } as never);
               },
               downloadArtifact(name: string, tempPath: string) {