Add syft for SBOM

defenseunicorns · Oct 9, 2024 · b4c2604 · b4c2604
1 parent c468bda
commit b4c2604
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/.github/workflows/vulnerability-scan.yaml → .github/workflows/container-scan.yaml b/.github/workflows/vulnerability-scan.yaml → .github/workflows/container-scan.yaml
@@ -12,7 +12,7 @@ on:
       - main
 
 jobs:
-  grype-scan:
+  container-scans:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
@@ -23,11 +23,15 @@ jobs:
           cache: "npm"
       - name: Install Pepr Dependencies
         run: npm ci
-      - name: Build Pepr Dev Image
+      - name: Build Pepr Controller Image
         run: npm run build:image
-      - name: Scan image
+      - name: Vulnerability Scan
         uses: anchore/scan-action@64a33b277ea7a1215a3c142735a1091341939ff5 # v4.1.2
         with:
           image: "pepr:dev"
           fail-build: true
           severity-cutoff: high
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: ghcr.io/example/image_name:tag
diff --git a/.github/workflows/semgrep.yaml b/.github/workflows/semgrep.yaml
@@ -23,6 +23,7 @@ jobs:
     name: semgrep/ci
     # If you are self-hosting, change the following `runs-on` value:
     runs-on: ubuntu-latest
+    continue-on-error: true
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
@@ -36,7 +37,6 @@ jobs:
       - uses: actions/checkout@v4
 
       - run: semgrep scan --error --quiet
-        continue-on-error: true
 
 
       - run: semgrep ci