vuln scan github summary

Author: corneliusludmann

.github/workflows/build.yml

@@ -308,6 +308,43 @@ jobs:
             )  >> $GITHUB_STEP_SUMMARY
           fi
 
+          exit $RESULT
+      - name: Scan for Vulnerabilities
+        id: scan
+        shell: bash
+        env:
+          NODE_OPTIONS: "--max_old_space_size=4096"
+          JAVA_HOME: /home/gitpod/.sdkman/candidates/java/current
+          VERSION: ${{needs.configuration.outputs.version}}
+          PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}}
+          PR_NO_TEST: ${{needs.configuration.outputs.build_no_test}}
+          NPM_AUTH_TOKEN: "${{ secrets.NPM_AUTH_TOKEN }}"
+          PUBLISH_TO_NPM: ${{ needs.configuration.outputs.publish_to_npm == 'true'  || needs.configuration.outputs.is_main_branch == 'true' }}
+          JB_MARKETPLACE_PUBLISH_TOKEN: "${{ secrets.JB_MARKETPLACE_PUBLISH_TOKEN }}"
+          PUBLISH_TO_JBPM: ${{ needs.configuration.outputs.publish_to_jbmp == 'true'  || needs.configuration.outputs.is_main_branch == 'true' }}
+          CODECOV_TOKEN: "${{ secrets.CODECOV_TOKEN }}"
+          LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}}
+          IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/build
+
+          # SCM tokens for integration tests
+          GITPOD_TEST_TOKEN_BITBUCKET: "${{ secrets.GITPOD_TEST_TOKEN_BITBUCKET }}"
+          GITPOD_TEST_TOKEN_BITBUCKET_SERVER: "${{ secrets.GITPOD_TEST_TOKEN_BITBUCKET_SERVER }}"
+          GITPOD_TEST_TOKEN_BITBUCKET_SERVER_WRITE: "${{ secrets.GITPOD_TEST_TOKEN_BITBUCKET_SERVER_WRITE }}"
+          GITPOD_TEST_TOKEN_BITBUCKET_SERVER_READ: "${{ secrets.GITPOD_TEST_TOKEN_BITBUCKET_SERVER_READ }}"
+          GITPOD_TEST_TOKEN_GITHUB: "${{ secrets.GITPOD_TEST_TOKEN_GITHUB }}"
+          GITPOD_TEST_TOKEN_GITLAB: "${{ secrets.GITPOD_TEST_TOKEN_GITLAB }}"
+          GITPOD_TEST_TOKEN_AZURE_DEVOPS: "${{ secrets.GITPOD_TEST_TOKEN_AZURE_DEVOPS }}"
+        run: |
+          [[ "$PR_NO_CACHE" = "true" ]] && CACHE="none"       || CACHE="remote"
+          [[ "$PR_NO_TEST"  = "true" ]] && TEST="--dont-test" || TEST=""
+          [[ "${PUBLISH_TO_NPM}" = 'true' ]] && NPM_PUBLISH_TRIGGER=$(date +%s%3N) || NPM_PUBLISH_TRIGGER="false"
+
+          # tmp: Update leeway from branch to make testing easier
+          LEEWAY_BRANCH=clu/sbom-cve-2
+          LEEWAY_REPO_DIR=$(mktemp -d -t leeway-repo-XXXXXXXXXX) && git clone https://github.com/gitpod-io/leeway "$LEEWAY_REPO_DIR" && cd "$LEEWAY_REPO_DIR" && git switch ${LEEWAY_BRANCH} && git pull && go build -ldflags="-X github.com/gitpod-io/leeway/pkg/leeway.Version=0.10.2.sbom" -o leeway && sudo install -m 755 leeway /usr/bin/ && cd - && rm -rf "$LEEWAY_REPO_DIR"
+
+          RESULT=0
+
           sboms_dir=$(mktemp -d)
           CI= leeway -v sbom export --with-dependencies --output-dir "$sboms_dir" \
             -Dversion=$VERSION \
@@ -335,19 +372,19 @@ jobs:
             echo "leeway_vulnerability_reports_dir=$scans_dir"
           } >> $GITHUB_OUTPUT
 
-          exit $RESULT
+          cat "$scans_dir/vulnerability-summary.md" >> $GITHUB_STEP_SUMMARY
       - name: Upload SBOMs
         uses: actions/upload-artifact@v4
         if: success()
         with:
           name: sboms
-          path: ${{ steps.leeway.outputs.leeway_sboms_dir }}
+          path: ${{ steps.scan.outputs.leeway_sboms_dir }}
       - name: Upload vulnerability reports
         uses: actions/upload-artifact@v4
         if: success()
         with:
           name: vulnerability-reports
-          path: ${{ steps.leeway.outputs.leeway_vulnerability_reports_dir }}
+          path: ${{ steps.scan.outputs.leeway_vulnerability_reports_dir }}
       - name: Tag the release
         if: github.ref == 'refs/heads/main'
         run: |