diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index b33ac1009..34fdf8e9c 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -320,6 +320,47 @@ jobs: +### Mapping the DOCKER_CONFIG Environment Variable + +When using a job's Docker daemon to pull private images, you might need to log in to your private registry before running **valint**. To ensure that the containerized action `action-bom` can access your private image, set `DOCKER_CONFIG` to a directory in your workflow that is accessible for mapping. + +Below is an example configuration: + +```yaml +env: + DOCKER_CONFIG: ${{ github.workspace }}/.docker + +steps: + - name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ${{ env.REGISTRY_URL }} + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + + - name: Generate cyclonedx json SBOM + uses: scribe-security/action-bom@master + with: + target: 'scribesecurity/example:latest' +``` + +Alternatively, you can use uncontainerized actions directly: + +```yaml +- name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ${{ env.REGISTRY_URL }} + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + +- name: Generate cyclonedx json SBOM + uses: scribe-security/action-bom-cli@master + with: + target: 'scribesecurity/example:latest' + format: json +``` + ### Running action as non root user By default, the action runs in its own pid namespace as the root user. You can change the user by setting specific `USERID` and `USERNAME` environment variables. @@ -464,7 +505,7 @@ Create SBOM for image hosted by a private registry. ```YAML env: - DOCKER_CONFIG: $HOME/.docker + DOCKER_CONFIG: ${{ github.workspace }}/.docker steps: - name: Login to GitHub Container Registry uses: docker/login-action@v2 @@ -477,7 +518,7 @@ steps: uses: scribe-security/action-bom@master with: target: 'scribesecurity/example:latest' - force: true + ``` diff --git a/docs/platforms/github-integration.md b/docs/platforms/github-integration.md index 22f5da5c3..a7af8ae92 100644 --- a/docs/platforms/github-integration.md +++ b/docs/platforms/github-integration.md @@ -79,7 +79,7 @@ env: LOG_LEVEL: "INFO" VALINT_SCRIBE_ENABLE: true DOCKER_DRIVER: overlay2 - DOCKER_CONFIG: $HOME/.docker + DOCKER_CONFIG: ${{ github.workspace }}/.docker DOCKERHUB_USERNAME: scribesecurity SCRIBE_PRODUCT_VERSION: "v0.0.2-github"