- fixing SBOM publishing for Java

Keeper-Security · Jan 2, 2025 · ee898dd · ee898dd
1 parent e9502fa
commit ee898dd
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/.github/workflows/reusable.sbom.workflow.yml b/.github/workflows/reusable.sbom.workflow.yml
@@ -300,6 +300,22 @@ jobs:
             ls -la $GRADLE_USER_HOME/caches || true
           fi
 
+      - name: Debug Syft scanning
+        if: inputs.project-type == 'java'
+        working-directory: ${{ inputs.working-directory }}
+        run: |
+          echo "Syft version:"
+          syft version
+          
+          echo "Scanning Gradle cache:"
+          find ~/.gradle/caches/modules-2 -type f -name "*.jar" | while read -r jar; do
+            echo "Found JAR: $jar"
+            syft packages "$jar" 2>/dev/null || true
+          done
+          
+          echo "Full project scan with verbose output:"
+          SYFT_LOG_LEVEL=debug syft packages . -o json | tee syft-scan.json
+
       - name: Verify Syft Java scanning
         if: inputs.project-type == 'java'
         working-directory: ${{ inputs.working-directory }}