{"id":51631062,"url":"https://github.com/semgrep/supply-chain-base-image","last_synced_at":"2026-07-13T07:03:43.109Z","repository":{"id":337971836,"uuid":"1156022112","full_name":"semgrep/supply-chain-base-image","owner":"semgrep","description":"Base Docker Image for Supply Chain","archived":false,"fork":false,"pushed_at":"2026-05-28T00:44:30.000Z","size":59,"stargazers_count":4,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-28T02:12:36.231Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/semgrep.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-12T07:00:09.000Z","updated_at":"2026-05-04T22:16:11.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/semgrep/supply-chain-base-image","commit_stats":null,"previous_names":["semgrep/supply-chain-base-image"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/semgrep/supply-chain-base-image","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsupply-chain-base-image","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsupply-chain-base-image/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsupply-chain-base-image/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsupply-chain-base-image/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/semgrep","download_url":"https://codeload.github.com/semgrep/supply-chain-base-image/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsupply-chain-base-image/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35413543,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-13T02:00:06.543Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-13T07:03:42.663Z","updated_at":"2026-07-13T07:03:43.104Z","avatar_url":"https://github.com/semgrep.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Supply Chain Base Image\n\nA ready-to-use Docker base image for generating lockfiles and Software Bills of Materials (SBOMs) from your source code. Built on `debian:bookworm-slim`, it provides a consistent foundation for supply chain analysis across multiple package managers.\n\n## Getting Started\n\n### Prerequisites\n\n- [Docker](https://docs.docker.com/get-docker/) installed on your machine\n\n### Quick Start\n\nPull the base image:\n\n```bash\ndocker pull ghcr.io/semgrep/supply-chain-base-image:main\n```\n\nThen pick an example below that matches your project's package manager, build it, and run it against your code.\n\n## How It Works\n\nThe base image sets up two standard directories:\n\n| Directory | Environment Variable | Purpose |\n|---|---|---|\n| `/semgrep/workspace` | `SEMGREP_WORKSPACE` | Where your source code gets mounted |\n| `/semgrep/outputs` | `SEMGREP_OUTPUT` | Where generated lockfiles or SBOMs are written for consumption by Semgrep |\n\nYou mount your project into the workspace, run a container, and collect the results from the outputs directory. No need to install package managers or tooling on your local machine.\n\n## Examples\n\nWe provide ready-to-use Dockerfiles for the most common package managers. Each example can be used as-is or customized for your specific needs.\n\n### Lockfile Generation\n\nDon't have a lockfile in your repository? These examples generate one from your project's manifest file (e.g., `package.json`, `pom.xml`, `pyproject.toml`).\n\n| Your Project Uses | Example | What Gets Generated |\n|---|---|---|\n| npm | [`examples/lockfiles/npm/`](examples/lockfiles/npm/) | `package-lock.json` |\n| Maven | [`examples/lockfiles/maven/`](examples/lockfiles/maven/) | `dependency-tree.txt` |\n| Poetry | [`examples/lockfiles/poetry/`](examples/lockfiles/poetry/) | `poetry.lock` |\n| uv | [`examples/lockfiles/uv/`](examples/lockfiles/uv/) | `uv.lock` |\n| pip | [`examples/lockfiles/pip/`](examples/lockfiles/pip/) | `requirements-locked.txt` |\n| Gradle | [`examples/lockfiles/gradle/`](examples/lockfiles/gradle/) | `gradle.lockfile` |\n| Bazel | [`examples/lockfiles/bazel/`](examples/lockfiles/bazel/) | `MODULE.bazel.lock` |\n\n**Example: Generate a lockfile for an npm project**\n\n```bash\n# 1. Build the image (one-time step)\ndocker build -t lockfile-npm examples/lockfiles/npm/\n\n# 2. Run it against your project\ndocker run --rm \\\n  -v \"$(pwd):/semgrep/workspace\" \\\n  -v \"./outputs:/semgrep/outputs\" \\\n  lockfile-npm\n\n# 3. Check the result\ncat outputs/package-lock.json\n```\n\n### SBOM Generation\n\nGenerate a [CycloneDX](https://cyclonedx.org/) Software Bill of Materials (SBOM) in JSON format. SBOMs provide a complete inventory of your project's dependencies, useful for vulnerability tracking and compliance.\n\n| Your Project Uses | Example | Tool Used |\n|---|---|---|\n| npm | [`examples/sbom/npm/`](examples/sbom/npm/) | `@cyclonedx/cyclonedx-npm` |\n| Maven | [`examples/sbom/maven/`](examples/sbom/maven/) | `cyclonedx-maven-plugin` |\n| Poetry | [`examples/sbom/poetry/`](examples/sbom/poetry/) | `cyclonedx-py` |\n| uv | [`examples/sbom/uv/`](examples/sbom/uv/) | `uv export` (built-in) |\n| pip | [`examples/sbom/pip/`](examples/sbom/pip/) | `cyclonedx-py` |\n| Gradle | [`examples/sbom/gradle/`](examples/sbom/gradle/) | `cyclonedx-gradle-plugin` |\n| Bazel | [`examples/sbom/bazel/`](examples/sbom/bazel/) | `cdxgen` |\n\nAll SBOM examples output a `bom.json` file to the outputs directory.\n\n**Example: Generate an SBOM for a Python (uv) project**\n\n```bash\n# 1. Build the image (one-time step)\ndocker build -t sbom-uv examples/sbom/uv/\n\n# 2. Run it against your project\ndocker run --rm \\\n  -v \"$(pwd):/semgrep/workspace\" \\\n  -v \"./outputs:/semgrep/outputs\" \\\n  sbom-uv\n\n# 3. Check the result\ncat outputs/bom.json\n```\n\n## Creating Your Own Image\n\nUse this base image as the starting point for your own Dockerfile. The workspace and output directories are already set up for you.\n\n```dockerfile\nFROM ghcr.io/semgrep/supply-chain-base-image:main\n\n# Install whatever tooling you need\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n    python3 \\\n    \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nCOPY my-script.sh /usr/local/bin/\n\n# Your script reads from $SEMGREP_WORKSPACE and writes to $SEMGREP_OUTPUT\nCMD [\"my-script.sh\"]\n```\n\n## Verifying the Image\n\nEvery image we publish is signed and includes [SLSA v1.0 Build L3](https://slsa.dev/) provenance and an embedded SBOM. You can verify that the image you pulled was built by our CI pipeline and hasn't been tampered with.\n\n### Verify build provenance\n\nRequires the [GitHub CLI](https://cli.github.com/):\n\n```bash\ngh attestation verify oci://ghcr.io/semgrep/supply-chain-base-image:main \\\n  -R semgrep/supply-chain-base-image\n```\n\n### Inspect the embedded SBOM and provenance\n\n```bash\n# View provenance\ndocker buildx imagetools inspect ghcr.io/semgrep/supply-chain-base-image:main \\\n  --format '{{ json .Provenance }}'\n\n# View SBOM\ndocker buildx imagetools inspect ghcr.io/semgrep/supply-chain-base-image:main \\\n  --format '{{ json .SBOM }}'\n```\n\n## Building the Base Image Locally\n\nIf you want to build the base image yourself instead of pulling from the registry:\n\n```bash\ndocker build -t supply-chain-base-image .\n```\n\n## License\n\nThis project is licensed under the [MIT License](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsemgrep%2Fsupply-chain-base-image","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsemgrep%2Fsupply-chain-base-image","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsemgrep%2Fsupply-chain-base-image/lists"}