Find End-of-life (EOL) software in files or containers

This is a GitHub Action for invoking the Xeol scanner and returning the end-of-life (EOL) packages. You can set it to fail pipelines when EOL software is found by setting the fail-build input to true.

Use this in your workflows to quickly verify files or containers' content after a build and before pushing, allowing PRs, or deploying updates.

The action invokes the xeol command-line tool, with these benefits:

• Runs locally, without sending data outbound - no credentials required!
• Speedy scan operations
• Scans both paths and container images

By default, a scan will produce very detailed output on system packages like an RPM or DEB, but also language-based packages. These are some of the supported packages and libraries:

Supported Linux Distributions:

• Alpine
• BusyBox
• CentOS and RedHat
• Debian and Debian-based distros like Ubuntu

Supported packages and libraries:

• Ruby Bundles
• Python Wheel, Egg, requirements.txt
• JavaScript NPM/Yarn
• Java JAR/EAR/WAR, Jenkins plugins JPI/HPI
• Go modules

The simplest workflow for scanning a localbuild/testimage container:

- name: Set up Docker Buildx
  uses: docker/setup-buildx-action@v1

- name: build local container
  uses: docker/build-push-action@v2
  with:
    tags: localbuild/testimage:latest
    push: false
    load: true

- name: Scan image
  uses: xeol-io/[email protected]
  with:
    image: "localbuild/testimage:latest"

To scan a directory, add the following step:

- name: Scan current project
  uses: xeol-io/[email protected]
  with:
    path: "."

The path key allows any valid path for the current project. The root of the path ("." in this example) is the repository root.

Use the sbom key to scan an SBOM file:

- name: Create SBOM
  uses: anchore/sbom-action@v0
  with:
    format: spdx-json
    output-file: "${{ github.event.repository.name }}-sbom.spdx.json"

- name: Scan SBOM
  uses: xeol-io/[email protected]
  with:
    sbom: "${{ github.event.repository.name }}-sbom.spdx.json"

By default, the action will fail if it finds any out-of-date software.

You change the fail-build field to false to avoid failing the build in the case that an out-of-date package is found:

- name: Scan image
  uses: xeol-io/[email protected]
  with:
    image: "localbuild/testimage:latest"
    fail-build: false

The inputs image, path, and sbom are mutually exclusive to specify the source to scan; all the other keys are optional. These are all the available keys to configure this action, along with the defaults:

Assuming your repository has a Dockerfile in the root directory:

name: Container Image CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Build the container image
        run: docker build . --file Dockerfile --tag localbuild/testimage:latest
      - uses: xeol-io/[email protected]
        with:
          image: "localbuild/testimage:latest"
          fail-build: true

A sub-action to download Xeol.

Input parameters:

Output parameters:

cmd can be referenced in a workflow like other output parameters: ${{ steps.<step-id>.outputs.cmd }}

Example usage:

- uses: xeol-io/xeol-action/download-xeol@v3
  id: xeol
- run: ${{steps.xeol.outputs.cmd}} dir:.

We love contributions, feedback, and bug reports. For issues with the invocation of this action, file issues in this repository.

For contributing, see Contributing.

For documentation on Xeol itself, including other output capabilities, see the xeol project

This action makes extensive use of GitHub Action debug logging, which can be enabled as described here by setting a secret in your repository of ACTIONS_STEP_DEBUG to true.