Parse GitHub actions comments (#3776)

* add version comment parsing support to github actions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with github actions metadata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add originator processing for github actions type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/format/internal/spdxutil/helpers/originator_supplier.go

@@ -34,7 +34,7 @@ const (
 //
 // Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
 // return values are: <type>, <value>
-func Originator(p pkg.Package) (typ string, author string) { //nolint: funlen
+func Originator(p pkg.Package) (typ string, author string) { //nolint: gocyclo,funlen
 	if !hasMetadata(p) {
 		return typ, author
 	}
@@ -57,6 +57,15 @@ func Originator(p pkg.Package) (typ string, author string) { //nolint: funlen
 	case pkg.DpkgArchiveEntry:
 		author = metadata.Maintainer
 
+	case pkg.GitHubActionsUseStatement:
+		typ = orgType
+		org := strings.Split(metadata.Value, "/")[0]
+		if org == "actions" {
+			// this is a GitHub action, so the org is GitHub
+			org = "GitHub"
+		}
+		author = org
+
 	case pkg.JavaArchive:
 		if metadata.Manifest != nil {
 			author = metadata.Manifest.Main.MustGet("Specification-Vendor")

syft/format/internal/spdxutil/helpers/originator_supplier_test.go

@@ -45,6 +45,7 @@ func Test_OriginatorSupplier(t *testing.T) {
 		pkg.SwiplPackEntry{},
 		pkg.OpamPackage{},
 		pkg.YarnLockEntry{},
+		pkg.TerraformLockProviderEntry{},
 	)
 	tests := []struct {
 		name       string
@@ -384,20 +385,24 @@ func Test_OriginatorSupplier(t *testing.T) {
 			supplier:   "Person: me (me@auth.com)",
 		},
 		{
-			name: "from ocaml opam",
+			name: "from github actions workflow/action",
 			input: pkg.Package{
-				Metadata: pkg.OpamPackage{},
+				Metadata: pkg.GitHubActionsUseStatement{
+					Value: "actions/checkout@v4",
+				},
 			},
-			originator: "",
-			supplier:   "",
+			originator: "Organization: GitHub",
+			supplier:   "Organization: GitHub",
 		},
 		{
-			name: "from terraform lock",
+			name: "from github actions workflow/action",
 			input: pkg.Package{
-				Metadata: pkg.TerraformLockProviderEntry{},
+				Metadata: pkg.GitHubActionsUseStatement{
+					Value: "google/something@v6",
+				},
 			},
-			originator: "",
-			supplier:   "",
+			originator: "Organization: google",
+			supplier:   "Organization: google",
 		},
 	}
 	for _, test := range tests {