From 5f3212a7100ac551d27d3fcf8113193ebd2999ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?= Date: Fri, 21 Aug 2026 18:49:59 -0600 Subject: [PATCH] Omit empty sbom-format from Verify invocation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The template-injection hardening in #901 moved the optional sbom-format input into a quoted env var. This turns into an empty string when the input is not set and the java invocation fails: Invalid file type: Process completed with exit code 1. But the action needs to omit the format positional argument to rely on the SPDX tools' format detection. This PR modifies the invocation to pass the value with ${INPUTS_SBOM_FORMAT:+...} so the argument is only passed when the input is non-empty. Signed-off-by: Adolfo García Veytia (Puerco) --- setup-spdx/action.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup-spdx/action.yaml b/setup-spdx/action.yaml index 385951ce..b241ad52 100644 --- a/setup-spdx/action.yaml +++ b/setup-spdx/action.yaml @@ -53,4 +53,4 @@ runs: INPUTS_SBOM_FORMAT: ${{ inputs.sbom-format }} shell: bash run: | - java -jar "./tools-java-${INPUTS_SPDX_TOOLS_VERSION}-jar-with-dependencies.jar" Verify "${INPUTS_SBOM_PATH}" "${INPUTS_SBOM_FORMAT}" + java -jar "./tools-java-${INPUTS_SPDX_TOOLS_VERSION}-jar-with-dependencies.jar" Verify "${INPUTS_SBOM_PATH}" ${INPUTS_SBOM_FORMAT:+"${INPUTS_SBOM_FORMAT}"}