debug workflow #1728

Signed-off-by: tdruez <[email protected]>

Author: tdruez

.github/workflows/sca-integration-anchore.yml

@@ -17,20 +17,27 @@ jobs:
   generate-and-load-sbom:
     runs-on: ubuntu-24.04
     steps:
-      - name: Generate CycloneDX SBOM with Anchore Syft
-        uses: anchore/sbom-action@v0
-        with:
-          image: ${{ env.IMAGE_REFERENCE }}
-          format: cyclonedx-json
-          output-file: "${{ github.event.repository.name }}-sbom.cdx.json"
-          artifact-name: "anchore-sylt-sbom.cdx.json"
-          upload-artifact: true
+#      - name: Generate CycloneDX SBOM with Anchore Syft
+#        uses: anchore/sbom-action@v0
+#        with:
+#          image: ${{ env.IMAGE_REFERENCE }}
+#          format: cyclonedx-json
+#          output-file: "${{ github.event.repository.name }}-sbom.cdx.json"
+#          artifact-name: "anchore-sylt-sbom.cdx.json"
+#          upload-artifact: true
+#
+#      - name: Scan SBOM with Grype scanner for vulnerabilities
+#        uses: anchore/scan-action@v6
+#        with:
+#          sbom: "${{ github.event.repository.name }}-sbom.cdx.json"
+#          output-format: cyclonedx-json
+#          output-file: "anchore-grype-sbom.cdx.json"
+#          fail-build: false
 
-      - name: Scan SBOM with Grype scanner for vulnerabilities
+      - name: Scan image
         uses: anchore/scan-action@v6
         with:
-#          sbom: "anchore-sylt-sbom.cdx.json"
-          sbom: "${{ github.event.repository.name }}-sbom.cdx.json"
+          image: ${{ env.IMAGE_REFERENCE }}
           output-format: cyclonedx-json
           output-file: "anchore-grype-sbom.cdx.json"
           fail-build: false
@@ -47,3 +54,8 @@ jobs:
         with:
           pipelines: "load_sbom"
           inputs-path: "anchore-grype-sbom.cdx.json"
+
+      - name: Verify SBOM Analysis Results in ScanCode.io
+        shell: bash
+        run: |
+          scanpipe shell --command "from scanpipe.models import DiscoveredPackage, DiscoveredDependency; package_manager = DiscoveredPackage.objects; print(package_manager.count()); print(package_manager.vulnerable().count()); print(DiscoveredDependency.objects.count())"