chore: update scans.yml

Author: edospadoni

.github/workflows/scans.yml

@@ -4,8 +4,8 @@ on:
   push:
     branches:
       - main
-    tags:
-      - 'v*'
+  release:
+    types: [published]
 
 permissions:
   actions: read
@@ -17,39 +17,48 @@ jobs:
   sbom:
     name: SBOM
     runs-on: ubuntu-22.04
+    if: github.event_name == 'push' || github.event_name == 'release'
     steps:
       - uses: actions/checkout@v4
-      - name: Generate
+
+      - name: Generate Trivy GitHub report
+        if: github.event_name == 'push'
         uses: aquasecurity/[email protected]
         with:
           scan-type: 'fs'
           scan-ref: '.'
           format: 'github'
           output: 'dependency-results.sbom.json'
           github-pat: ${{ secrets.GITHUB_TOKEN }}
-      - name: Scan
+
+      - name: Generate Trivy SARIF report
+        if: github.event_name == 'push'
         uses: aquasecurity/[email protected]
         with:
           scan-type: 'fs'
           scan-ref: '.'
           format: 'sarif'
           output: 'trivy-results.sarif'
           github-pat: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload
+
+      - name: Upload SARIF
+        if: github.event_name == 'push'
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'trivy-results.sarif'
-      - name: Generate SBOM
-        if: startsWith(github.ref, 'refs/tags/')
+
+      - name: Generate SBOM (CycloneDX)
+        if: github.event_name == 'release'
         uses: aquasecurity/[email protected]
         with:
           scan-type: 'fs'
           scan-ref: '.'
           format: cyclonedx
           output: sbom.cdx.json
-      - name: Attach SBOM
-        if: startsWith(github.ref, 'refs/tags/')
+
+      - name: Attach SBOM to release
+        if: github.event_name == 'release'
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload ${{ github.ref_name }} sbom.cdx.json
+          gh release upload "${{ github.event.release.tag_name }}" sbom.cdx.json --clobber