[CRAVEX] SCA Integrations: Trivy #12

	name: Generate SBOM with Trivy

	on:
	workflow_dispatch:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	env:
	IMAGE_REFERENCE: "python:3.13.0-slim"

	jobs:
	generate-sbom:
	runs-on: ubuntu-24.04
	steps:
	- name: Run Trivy in CycloneDX SBOM mode
	uses: aquasecurity/[email protected]
	with:
	scan-type: "image"
	image-ref: ${{ env.IMAGE_REFERENCE }}
	format: "cyclonedx"
	output: "trivy-report.sbom.json"
	scanners: "vuln,license"
	version: "latest"

	- name: Upload Trivy report as a Github artifact
	uses: actions/upload-artifact@v4
	with:
	name: upload-trivy-sbom-report
	path: "${{ github.workspace }}/trivy-report.sbom.json"
	retention-days: 20

	- name: Load the Trivy report SBOM into ScanCode.io
	uses: aboutcode-org/scancode-action@file-as-inputs-path
	with:
	pipelines: "load_sbom"
	inputs-path: "${{ github.workspace }}/trivy-report.sbom.json"

	# - name: Use project name
	# run: echo "Project is ${{ steps.scancode.inputs.project-name }}"

	- name: Test running scanpipe for checking the loaded content
	shell: bash
	run: \|
	scanpipe shell --command "from scanpipe.models import DiscoveredPackage; print(DiscoveredPackage.objects.count())"

	# - name: Test running scanpipe for checking the loaded content
	# shell: bash
	# run: \|
	# scanpipe status --project ${{ steps.scancode.inputs.project-name }}

Provide feedback