TEST sbom with syft anf grype

Author: chiaramapellimt

.github/workflows/test-sbom.yml

@@ -0,0 +1,65 @@
+name: Release adaptor container image
+
+on:
+  push:
+    branches:
+      - test-sbom
+
+jobs:
+  reusable_workflow_job:
+    name: Push Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            nhsdev/${{ inputs.dockerhub_name }}
+          tags: |
+            type=semver,pattern={{version}}
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/docker/${{ inputs.folder }}/Dockerfile
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/${{ inputs.folder }}/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/arm64/v8,linux/amd64
+          load: true
+
+      - name: syft
+        uses: anchore/sbom-action@v0
+        with:
+          image: ${{ fromJSON(steps.meta.outputs.tags)[0] }}
+          format: spdx-json
+          output-file: sbom.spdx.json
+
+      - name: grype
+        uses: anchore/scan-action@v0
+        with:
+          image: ${{ fromJSON(steps.meta.outputs.tags)[0] }}
+          output-file: vulnerabilities.json
+          fail-on-severity: high
+
+      - name: Upload security reports as artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: security-reports
+          path: |
+            sbom.spdx.json
+            vulnerabilities.json