Merge pull request #3 from actions/eugene/attest-sbom

init attest sbom
2024-02-23 15:14:10 -08:00
parent 622dcc06e2 9a8656b2b0
commit 2580b8b5da
17 changed files with 25848 additions and 365 deletions
@@ -5,25 +5,27 @@ on:
  push:
    branches:
      - main
+      - 'releases/*'

-permissions:
-  contents: read
+permissions: {}

 jobs:
  test-typescript:
    name: TypeScript Tests
    runs-on: ubuntu-latest
+    permissions:
+      contents: read

    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Setup Node.js
        id: setup-node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
        with:
-          node-version-file: .node-version
+          node-version: 18
          cache: npm

      - name: Install Dependencies
@@ -37,26 +39,55 @@ jobs:
      - name: Lint
        id: npm-lint
        run: npm run lint
+      # - name: Test
+      #   id: npm-ci-test
+      #   run: npm run ci-test

-      - name: Test
-        id: npm-ci-test
-        run: npm run ci-test
-
-  test-action:
-    name: GitHub Actions Test
+  test-attest-sbom-with-local-sbom-file:
+    name: Test attest-sbom action with local sbom file 
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write

    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
-
-      - name: Test Local Action
-        id: test-action
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Run attest-sbom
+        id: attest-sbom
        uses: ./
        with:
-          milliseconds: 2000
+          subject-digest: 'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+          subject-name: 'subject'
+          sbom-path: '__tests__/data/sbom.json'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Dump output
+        run: jq < ${{ steps.attest-sbom.outputs.bundle-path }}
+  test-attest-sbom:
+    name: Test attest-sbom action
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write

-      - name: Print Output
-        id: output
-        run: echo "${{ steps.test-action.outputs.time }}"
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Run attest-sbom with spdx format
+        uses: ./
+        with:
+          subject-digest: 'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+          subject-name: 'subject'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          format: 'spdx'
+      - name: Run attest-sbom with cyclonedx format
+        uses: ./
+        with:
+          subject-digest: 'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+          subject-name: 'subject'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          format: 'cyclonedx'
@@ -31,7 +31,7 @@ jobs:
      - name: Install Dependencies
        id: install
        run: npm ci
-
+      
      - name: Lint Codebase
        id: super-linter
        uses: super-linter/super-linter/slim@v5
@@ -100,4 +100,4 @@ __tests__/runner/*
 # IDE files
 .idea
 .vscode
-*.code-workspace
+*.code-workspace
@@ -0,0 +1,41 @@
+{
+    "spdxVersion": "SPDX-2.3",
+    "dataLicense": "CC0-1.0",
+    "SPDXID": "SPDXRef-DOCUMENT",
+    "name": "./",
+    "documentNamespace": "https://anchore.com/syft/dir/80b363b6-87f4-4162-853f-60d402537d20",
+    "creationInfo": {
+      "licenseListVersion": "3.22",
+      "creators": [
+        "Organization: Anchore, Inc",
+        "Tool: syft-0.103.1"
+      ],
+      "created": "2024-01-31T18:22:50Z"
+    },
+    "packages": [
+      {
+        "name": "@ampproject/remapping",
+        "SPDXID": "SPDXRef-Package-npm--ampproject-remapping-5266573ba4f24a42",
+        "versionInfo": "2.2.1",
+        "supplier": "NOASSERTION",
+        "downloadLocation": "NOASSERTION",
+        "filesAnalyzed": false,
+        "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
+        "licenseConcluded": "NOASSERTION",
+        "licenseDeclared": "Apache-2.0",
+        "copyrightText": "NOASSERTION",
+        "externalRefs": [
+          {
+            "referenceCategory": "SECURITY",
+            "referenceType": "cpe23Type",
+            "referenceLocator": "cpe:2.3:a:\\@ampproject\\/remapping:\\@ampproject\\/remapping:2.2.1:*:*:*:*:*:*:*"
+          },
+          {
+            "referenceCategory": "PACKAGE-MANAGER",
+            "referenceType": "purl",
+            "referenceLocator": "pkg:npm/%40ampproject/[email protected]"
+          }
+        ]
+      }
+    ]
+}
@@ -1,17 +0,0 @@
-/**
- * Unit tests for the action's entrypoint, src/index.ts
- */
-
-import * as main from '../src/main'
-
-// Mock the action's entrypoint
-const runMock = jest.spyOn(main, 'run').mockImplementation()
-
-describe('index', () => {
-  it('calls run when imported', async () => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    require('../src/index')
-
-    expect(runMock).toHaveBeenCalled()
-  })
-})
@@ -1,89 +0,0 @@
-/**
- * Unit tests for the action's main functionality, src/main.ts
- *
- * These should be run as if the action was called from a workflow.
- * Specifically, the inputs listed in `action.yml` should be set as environment
- * variables following the pattern `INPUT_<INPUT_NAME>`.
- */
-
-import * as core from '@actions/core'
-import * as main from '../src/main'
-
-// Mock the action's main function
-const runMock = jest.spyOn(main, 'run')
-
-// Other utilities
-const timeRegex = /^\d{2}:\d{2}:\d{2}/
-
-// Mock the GitHub Actions core library
-let debugMock: jest.SpyInstance
-let errorMock: jest.SpyInstance
-let getInputMock: jest.SpyInstance
-let setFailedMock: jest.SpyInstance
-let setOutputMock: jest.SpyInstance
-
-describe('action', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-
-    debugMock = jest.spyOn(core, 'debug').mockImplementation()
-    errorMock = jest.spyOn(core, 'error').mockImplementation()
-    getInputMock = jest.spyOn(core, 'getInput').mockImplementation()
-    setFailedMock = jest.spyOn(core, 'setFailed').mockImplementation()
-    setOutputMock = jest.spyOn(core, 'setOutput').mockImplementation()
-  })
-
-  it('sets the time output', async () => {
-    // Set the action's inputs as return values from core.getInput()
-    getInputMock.mockImplementation((name: string): string => {
-      switch (name) {
-        case 'milliseconds':
-          return '500'
-        default:
-          return ''
-      }
-    })
-
-    await main.run()
-    expect(runMock).toHaveReturned()
-
-    // Verify that all of the core library functions were called correctly
-    expect(debugMock).toHaveBeenNthCalledWith(1, 'Waiting 500 milliseconds ...')
-    expect(debugMock).toHaveBeenNthCalledWith(
-      2,
-      expect.stringMatching(timeRegex)
-    )
-    expect(debugMock).toHaveBeenNthCalledWith(
-      3,
-      expect.stringMatching(timeRegex)
-    )
-    expect(setOutputMock).toHaveBeenNthCalledWith(
-      1,
-      'time',
-      expect.stringMatching(timeRegex)
-    )
-    expect(errorMock).not.toHaveBeenCalled()
-  })
-
-  it('sets a failed status', async () => {
-    // Set the action's inputs as return values from core.getInput()
-    getInputMock.mockImplementation((name: string): string => {
-      switch (name) {
-        case 'milliseconds':
-          return 'this is not a number'
-        default:
-          return ''
-      }
-    })
-
-    await main.run()
-    expect(runMock).toHaveReturned()
-
-    // Verify that all of the core library functions were called correctly
-    expect(setFailedMock).toHaveBeenNthCalledWith(
-      1,
-      'milliseconds not a number'
-    )
-    expect(errorMock).not.toHaveBeenCalled()
-  })
-})
@@ -1,25 +0,0 @@
-/**
- * Unit tests for src/wait.ts
- */
-
-import { wait } from '../src/wait'
-import { expect } from '@jest/globals'
-
-describe('wait.ts', () => {
-  it('throws an invalid number', async () => {
-    const input = parseInt('foo', 10)
-    expect(isNaN(input)).toBe(true)
-
-    await expect(wait(input)).rejects.toThrow('milliseconds not a number')
-  })
-
-  it('waits with a valid number', async () => {
-    const start = new Date()
-    await wait(500)
-    const end = new Date()
-
-    const delta = Math.abs(end.getTime() - start.getTime())
-
-    expect(delta).toBeGreaterThan(450)
-  })
-})
@@ -1,24 +1,101 @@
-name: 'The name of your action here'
-description: 'Provide a description here'
-author: 'Your name or organization here'
+name: 'Attest SBOM'
+description: 'Generate SBOM attestations for build artifacts'
+author: 'GitHub'

-# Add your action's branding here. This will appear on the GitHub Marketplace.
-branding:
-  icon: 'heart'
-  color: 'red'
-
-# Define your inputs here.
 inputs:
-  milliseconds:
-    description: 'Your input description here'
-    required: true
-    default: '1000'
+  path:
+    required: false
+    description: "A path to a directory on the filesystem to scan"
+    default: "."

-# Define your outputs here.
+  format:
+    required: false
+    description: "The SBOM format to export"
+    default: "spdx-json"
+
+  github-token:
+    description: >
+      The GitHub token used to make authenticated API requests.
+    default: ${{ github.token }}
+    required: false
+  subject-path:
+    description: >
+      Path to the artifact for which provenance will be generated. Must specify
+      exactly one of "subject-path" or "subject-digest".
+    required: false
+  subject-digest:
+    description: >
+      Digest of the subject for which provenance will be generated. Must be in
+      the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify
+      exactly one of "subject-path" or "subject-digest".
+    required: false
+  subject-name:
+    description: >
+      Subject name as it should appear in the provenance statement. Required
+      unless "subject-path" is specified, in which case it will be inferred from
+      the path.
+  push-to-registry:
+    description: >
+      Whether to push the provenance statement to the image registry. Requires
+      that the "subject-name" parameter specify the fully-qualified image name
+      and that the "subject-digest" parameter be specified. Defaults to false.
+    default: false
+    required: false
+  sbom-path:
+    description: >
+      Path to the SBOM file to generate sbom statement.
+    required: false
+    default: ''
 outputs:
-  time:
-    description: 'Your output description here'
+  bundle-path:
+    description: 'The path to the file containing the attestation bundle(s).'
+    value: ${{ steps.attest.outputs.bundle-path }}

 runs:
-  using: node20
-  main: dist/index.js
+  using: 'composite'
+  steps:   
+    - name: Generate random SBOM output file name
+      if: ${{ inputs.sbom-path == '' }}
+      run: echo "SBOM_FILENAME=${{ runner.temp }}/sbom_$(openssl rand -hex 6).json" >> $GITHUB_ENV
+      shell: bash
+    - name: SBOM format check
+      if: ${{ inputs.sbom-path == '' }}
+      run: |
+        if [ "${{inputs.format}}" != "spdx-json" ] && [ "${{inputs.format}}" != "cyclonedx-json" ] && [ "${{inputs.format}}" != "spdx" ] && [ "${{inputs.format}}" != "cyclonedx" ] ]; then
+          echo "Invalid SBOM format. Supported formats are spdx-json, cyclonedx-json, spdx, cyclonedx"
+          exit 1
+        fi
+        echo "SBOM_FORMAT=${{inputs.format}}" >> $GITHUB_ENV
+        if [ "${{inputs.format}}" == "spdx" ]; then
+          echo "SBOM_FORMAT=spdx-json" >> $GITHUB_ENV
+        elif [ "${{inputs.format}}" == "cyclonedx" ]; then
+          echo "SBOM_FORMAT=cyclonedx-json" >> $GITHUB_ENV
+        fi
+      shell: bash
+    - name: Generate SBOM
+      if: ${{ inputs.sbom-path == '' }}
+      uses: anchore/sbom-action@v0
+      with:
+        path: ${{inputs.path}}
+        output-file: ${{env.SBOM_FILENAME}}
+        format: ${{env.SBOM_FORMAT}}
+        config: ${{inputs.config}}
+    - uses: ./generate-sbom-statement
+      id: generate-sbom-statement
+      with:
+        github-token: ${{ inputs.github-token }}
+        subject-path: ${{ inputs.subject-path }}
+        subject-digest: ${{ inputs.subject-digest }}
+        subject-name: ${{ inputs.subject-name }}
+        push-to-registry: ${{ inputs.push-to-registry }}
+        sbom-path: ${{ inputs.sbom-path || env.SBOM_FILENAME }}
+    - uses: actions/attest@main
+      id: attest
+      with:
+        github-token: ${{ inputs.github-token }}
+        subject-path: ${{ inputs.subject-path }}
+        subject-digest: ${{ inputs.subject-digest }}
+        subject-name: ${{ inputs.subject-name }}
+        push-to-registry: ${{ inputs.push-to-registry }}
+        predicate-type: ${{ steps.generate-sbom-statement.outputs.predicate-type }}
+        predicate-path: ${{ steps.generate-sbom-statement.outputs.predicate-path }}
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="106" height="20" role="img" aria-label="Coverage: 100%"><title>Coverage: 100%</title><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="106" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#r)"><rect width="63" height="20" fill="#555"/><rect x="63" width="43" height="20" fill="#4c1"/><rect width="106" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text aria-hidden="true" x="325" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="530">Coverage</text><text x="325" y="140" transform="scale(.1)" fill="#fff" textLength="530">Coverage</text><text aria-hidden="true" x="835" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="330">100%</text><text x="835" y="140" transform="scale(.1)" fill="#fff" textLength="330">100%</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="92" height="20" role="img" aria-label="Coverage: 0%"><title>Coverage: 0%</title><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="92" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#r)"><rect width="63" height="20" fill="#555"/><rect x="63" width="29" height="20" fill="#e05d44"/><rect width="92" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text aria-hidden="true" x="325" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="530">Coverage</text><text x="325" y="140" transform="scale(.1)" fill="#fff" textLength="530">Coverage</text><text aria-hidden="true" x="765" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="190">0%</text><text x="765" y="140" transform="scale(.1)" fill="#fff" textLength="190">0%</text></g></svg>
@@ -35,6 +35,28 @@ WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.


+@fastify/busboy
+MIT
+Copyright Brian White. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
+
 tunnel
 MIT
 The MIT License (MIT)
@@ -60,6 +82,31 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.


+undici
+MIT
+MIT License
+
+Copyright (c) Matteo Collina and Undici contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 uuid
 MIT
 The MIT License (MIT)
@@ -0,0 +1,47 @@
+name: 'Generate SBOM Statement'
+description: 'Generate SBOM Statement for build artifacts'
+author: 'GitHub'
+
+inputs:
+  github-token:
+    description: >
+      The GitHub token used to make authenticated API requests.
+    default: ${{ github.token }}
+    required: false
+  subject-path:
+    description: >
+      Path to the artifact for which provenance will be generated. Must specify
+      exactly one of "subject-path" or "subject-digest".
+    required: false
+  subject-digest:
+    description: >
+      Digest of the subject for which provenance will be generated. Must be in
+      the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify
+      exactly one of "subject-path" or "subject-digest".
+    required: false
+  subject-name:
+    description: >
+      Subject name as it should appear in the provenance statement. Required
+      unless "subject-path" is specified, in which case it will be inferred from
+      the path.
+  push-to-registry:
+    description: >
+      Whether to push the provenance statement to the image registry. Requires
+      that the "subject-name" parameter specify the fully-qualified image name
+      and that the "subject-digest" parameter be specified. Defaults to false.
+    default: false
+    required: false
+  sbom-path:
+    description: >
+      Path to the SBOM file to generate sbom statement
+    required: false
+outputs:
+  predicate-path:
+    description: >
+      The path to the JSON-serialized of the attestation predicate 
+  predicate-type:
+    description: >
+      URI identifying the type of the predicate.
+runs:
+  using: node20
+  main: ../dist/index.js
@@ -70,7 +70,7 @@
  },
  "devDependencies": {
    "@types/jest": "^29.5.12",
-    "@types/node": "^20.11.17",
+    "@types/node": "^20.11.19",
    "@typescript-eslint/eslint-plugin": "^6.21.0",
    "@typescript-eslint/parser": "^6.21.0",
    "@vercel/ncc": "^0.38.1",
@@ -1,5 +1,9 @@
 import * as core from '@actions/core'
-import { wait } from './wait'
+import {
+  parseSBOMFromPath,
+  storePredicate,
+  generateSBOMPredicate
+} from './sbom'

 /**
 * The main function for the action.
@@ -7,20 +11,21 @@ import { wait } from './wait'
 */
 export async function run(): Promise<void> {
  try {
-    const ms: string = core.getInput('milliseconds')
+    const sbomPath = core.getInput('sbom-path')

-    // Debug logs are only output if the `ACTIONS_STEP_DEBUG` secret is true
-    core.debug(`Waiting ${ms} milliseconds ...`)
+    core.debug(`Reading SBOM from ${sbomPath}`)
+    const sbom = await parseSBOMFromPath(sbomPath)

-    // Log the current timestamp, wait, then log the new timestamp
-    core.debug(new Date().toTimeString())
-    await wait(parseInt(ms, 10))
-    core.debug(new Date().toTimeString())
+    // Calculate subject from inputs and generate provenance
+    const predicate = generateSBOMPredicate(sbom)

-    // Set outputs for other workflow steps to use
-    core.setOutput('time', new Date().toTimeString())
-  } catch (error) {
+    const predicatePath = storePredicate(predicate)
+
+    core.setOutput('predicate-path', predicatePath)
+    core.setOutput('predicate-type', predicate.type)
+  } catch (err) {
+    const error = err instanceof Error ? err : new Error(`${err}`)
    // Fail the workflow run if an error occurs
-    if (error instanceof Error) core.setFailed(error.message)
+    core.setFailed(error.message)
  }
 }
@@ -0,0 +1,102 @@
+import fs from 'fs'
+import * as path from 'path'
+
+export type SBOM = {
+  type: 'spdx' | 'cyclonedx'
+  object: object
+}
+
+type Predicate = {
+  type: string
+  params: object
+}
+
+export async function parseSBOMFromPath(filePath: string): Promise<SBOM> {
+  // Read the file content
+  const fileContent = await fs.promises.readFile(filePath, 'utf8')
+
+  const sbom = JSON.parse(fileContent)
+
+  if (checkIsSPDX(sbom)) {
+    return { type: 'spdx', object: sbom }
+  } else if (checkIsCycloneDX(sbom)) {
+    return { type: 'cyclonedx', object: sbom }
+  }
+  throw new Error('Unsupported SBOM format')
+}
+
+function checkIsSPDX(sbomObject: {
+  spdxVersion?: string
+  SPDXID?: string
+}): boolean {
+  if (sbomObject?.spdxVersion && sbomObject?.SPDXID) {
+    return true
+  } else {
+    return false
+  }
+}
+
+function checkIsCycloneDX(sbomObject: {
+  bomFormat?: string
+  serialNumber?: string
+  specVersion?: string
+}): boolean {
+  if (
+    sbomObject?.bomFormat &&
+    sbomObject?.serialNumber &&
+    sbomObject?.specVersion
+  ) {
+    return true
+  } else {
+    return false
+  }
+}
+
+export const storePredicate = (predicate: Predicate): string => {
+  // random tempfile
+  const basePath = process.env['RUNNER_TEMP']
+
+  if (!basePath) {
+    throw new Error('Missing RUNNER_TEMP environment variable')
+  }
+
+  const tmpDir = fs.mkdtempSync(path.join(basePath, path.sep))
+  const tempFile = path.join(tmpDir, 'predicate.json')
+
+  // write predicate to file
+  fs.writeFileSync(tempFile, JSON.stringify(predicate.params))
+  return tempFile
+}
+
+export const generateSBOMPredicate = (sbom: SBOM): Predicate => {
+  if (sbom.type === 'spdx') {
+    return generateSPDXIntoto(sbom.object)
+  }
+  if (sbom.type === 'cyclonedx') {
+    return generateCycloneDXIntoto(sbom.object)
+  }
+  throw new Error('Unsupported SBOM format')
+}
+
+// ref: https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md
+const generateSPDXIntoto = (sbom: object): Predicate => {
+  const spdxVersion = (sbom as { spdxVersion?: string })?.['spdxVersion']
+  if (!spdxVersion) {
+    throw new Error('Cannot find spdxVersion in the SBOM')
+  }
+
+  const version = spdxVersion.split('-')[1]
+
+  return {
+    type: `https://spdx.dev/Document/v${version}`,
+    params: sbom
+  }
+}
+
+// ref: https://github.com/in-toto/attestation/blob/main/spec/predicates/cyclonedx.md
+const generateCycloneDXIntoto = (sbom: object): Predicate => {
+  return {
+    type: 'https://cyclonedx.org/bom',
+    params: sbom
+  }
+}
@@ -1,14 +0,0 @@
-/**
- * Wait for a number of milliseconds.
- * @param milliseconds The number of milliseconds to wait.
- * @returns {Promise<string>} Resolves with 'done!' after the wait is over.
- */
-export async function wait(milliseconds: number): Promise<string> {
-  return new Promise(resolve => {
-    if (isNaN(milliseconds)) {
-      throw new Error('milliseconds not a number')
-    }
-
-    setTimeout(() => resolve('done!'), milliseconds)
-  })
-}