Improve SBOM format handling

README.md

@@ -120,7 +120,7 @@ and uploading them as workflow artifacts and release assets.
 | `registry-username` | The registry username to use when authenticating to an external registry                                                                     |
 | `registry-password` | The registry password to use when authenticating to an external registry                                                                     |
 | `artifact-name`     | The name to use for the generated SBOM artifact. See: [Naming the SBOM output](#naming-the-sbom-output)                                      | `sbom-<job>-<step-id>.spdx` |
-| `format`            | The SBOM format to export. One of: `spdx`, `spdx-json`, `cyclonedx`                                                                          | `spdx-json`                 |
+| `format`            | The SBOM format to export. One of: `spdx`, `spdx-json`, `cyclonedx`, `cyclonedx-json`                                                        | `spdx-json`                 |
 
 ### anchore/sbom-action/publish-sbom
 
@@ -134,9 +134,9 @@ A sub-action to [upload multiple SBOMs](publish-sbom/action.yml) to GitHub relea
 
 A sub-action to [download Syft](download-syft/action.yml).
 
-| Parameter             | Description                       | Default             |
-| --------------------- | --------------------------------- | ------------------- |
-| `syft-version`        | The version of Syft to download   |                     |
+| Parameter      | Description                     | Default |
+| -------------- | ------------------------------- | ------- |
+| `syft-version` | The version of Syft to download |         |
 
 Output parameters:
 

src/Syft.ts

@@ -25,6 +25,15 @@ export interface SyftImageInput {
  */
 export interface SyftOptions {
   input: SyftDirectoryInput | SyftRegistryInput | SyftImageInput;
-  format: "spdx" | "spdx-json" | "cyclonedx" | "table" | "text" | "json";
+  format:
+    | "spdx"
+    | "spdx-tag-value"
+    | "spdx-json"
+    | "cyclonedx"
+    | "cyclonedx-xml"
+    | "cyclonedx-json"
+    | "table"
+    | "text"
+    | "json";
   uploadToDependencySnapshotAPI: boolean;
 }

src/github/SyftGithubAction.ts

@@ -7,6 +7,7 @@ import {
   ReleaseEvent,
 } from "@octokit/webhooks-types";
 import * as fs from "fs";
+import os from "os";
 import path from "path";
 import stream from "stream";
 import { SyftOptions } from "../Syft";
@@ -25,7 +26,7 @@ export const SYFT_VERSION = core.getInput("syft-version") || VERSION;
 
 const PRIOR_ARTIFACT_ENV_VAR = "ANCHORE_SBOM_ACTION_PRIOR_ARTIFACT";
 
-const tempDir = fs.mkdtempSync("sbom-action-");
+const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "sbom-action-"));
 const githubDependencySnapshotFile = `${tempDir}/github.sbom.json`;
 
 /**
@@ -43,9 +44,20 @@ export function getArtifactName(): string {
   const format = getSbomFormat();
   let extension: string = format;
   switch (format) {
+    case "spdx":
+    case "spdx-tag-value":
+      extension = "spdx";
+      break;
     case "spdx-json":
       extension = "spdx.json";
       break;
+    case "cyclonedx":
+    case "cyclonedx-xml":
+      extension = "cyclonedx.xml";
+      break;
+    case "cyclonedx-json":
+      extension = "cyclonedx.json";
+      break;
     case "json":
       extension = "syft.json";
       break;

tests/SyftGithubAction.test.ts

@@ -277,6 +277,44 @@ describe("Action", () => {
     expect(action.getArtifactName()).toBe("something-something-image-image.spdx.json");
   });
 
+  it("format informs artifact name", () => {
+    setData({
+      inputs: {
+        image: "img",
+        format: "spdx",
+      }
+    });
+
+    expect(action.getArtifactName()).toBe("img.spdx");
+
+    setData({
+      inputs: {
+        image: "img",
+        format: "spdx-json",
+      }
+    });
+
+    expect(action.getArtifactName()).toBe("img.spdx.json");
+
+    setData({
+      inputs: {
+        image: "img",
+        format: "cyclonedx",
+      }
+    });
+
+    expect(action.getArtifactName()).toBe("img.cyclonedx.xml");
+
+    setData({
+      inputs: {
+        image: "img",
+        format: "cyclonedx-json",
+      }
+    });
+
+    expect(action.getArtifactName()).toBe("img.cyclonedx.json");
+  });
+
   it ("properly maps paths for WSL", () => {
     expect(mapToWSLPath("basic arg")).toBe("basic arg");
     expect(mapToWSLPath("D:\\Some\\Path")).toBe("/mnt/d/Some/Path");