FossID Workbench
These nodes let a workflow drive a FossID Workbench instance: evaluate its gates and pull its reports as part of an automated pipeline.
Both require a FossID Workbench connection.
Workbench Review
Runs review-stage actions in FossID Workbench, most usefully evaluating gates against a scan and failing the node when the criteria you set are not met.
Because a failed gate takes the node's failure path, this is how you make a workflow stop — or divert — on a Workbench policy result.
| Category | FossID Workbench |
| Input | file |
| Output | file |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| Workbench Connection | connection — required | — | The Workbench instance to use. |
| Command | test-connection, evaluate-gates — required | evaluate-gates | Which review command to run. |
| Project Name | string | — | Explicit Workbench project name. Use when running this node standalone. |
| Scan Name | string | — | Explicit Workbench scan name. Use when running this node standalone. |
| Fail On Pending | boolean | false | Fail if identifications are still pending. |
| Fail On Policy | boolean | false | Fail when there are policy violations. |
| Fail On Vuln Severity | critical, high, medium, low | — | Fail when a vulnerability at or above this severity is present. |
| Execute Real Workbench | boolean | true | Run real Workbench commands. Disable only for dry-run testing. |
The three Fail On … options are the gate. With all of them off, the node
reports but never fails.
Workbench Report
Runs reporting-stage actions in FossID Workbench — primarily downloading reports for a project or a scan.
| Category | FossID Workbench |
| Input | file |
| Output | file |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| Workbench Connection | connection — required | — | The Workbench instance to use. |
| Command | test-connection, download-reports — required | download-reports | Which report command to run. |
| Report Scope | project, scan | scan | Whether to download report data for a whole project or a single scan. |
| Project Name | string | — | Explicit Workbench project name. Use when running this node standalone. |
| Scan Name | string | — | Explicit Workbench scan name. Use when running this node standalone. |
| Report Type | all, spdx, cyclone_dx, spdx_lite, xlsx, html, string_match, dynamic_top_matched_components | spdx | Which report to download. all downloads every format available for the chosen scope. |
| Execute Real Workbench | boolean | true | Run real Workbench commands. Disable only for dry-run testing. |
Reports come out as file. If you want to process an SBOM report further —
normalize it, merge it, check it for compliance — follow this node with
Read CycloneDX or
Read SPDX.
Related
- Setting up connections.
- Edges and data flow — using failure paths to act on a failed gate.