vuln scan github summary

Author: corneliusludmann

.github/workflows/build.yml

@@ -308,6 +308,24 @@ jobs:
             )  >> $GITHUB_STEP_SUMMARY
           fi
 
+          exit $RESULT
+      - name: Scan for Vulnerabilities
+        id: scan
+        shell: bash
+        env:
+          NODE_OPTIONS: "--max_old_space_size=4096"
+          JAVA_HOME: /home/gitpod/.sdkman/candidates/java/current
+          VERSION: ${{needs.configuration.outputs.version}}
+          PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}}
+          PR_NO_TEST: ${{needs.configuration.outputs.build_no_test}}
+          NPM_AUTH_TOKEN: "${{ secrets.NPM_AUTH_TOKEN }}"
+          PUBLISH_TO_NPM: ${{ needs.configuration.outputs.publish_to_npm == 'true'  || needs.configuration.outputs.is_main_branch == 'true' }}
+          JB_MARKETPLACE_PUBLISH_TOKEN: "${{ secrets.JB_MARKETPLACE_PUBLISH_TOKEN }}"
+          PUBLISH_TO_JBPM: ${{ needs.configuration.outputs.publish_to_jbmp == 'true'  || needs.configuration.outputs.is_main_branch == 'true' }}
+          CODECOV_TOKEN: "${{ secrets.CODECOV_TOKEN }}"
+          LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}}
+          IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/build
+        run: |
           sboms_dir=$(mktemp -d)
           CI= leeway -v sbom export --with-dependencies --output-dir "$sboms_dir" \
             -Dversion=$VERSION \
@@ -335,19 +353,19 @@ jobs:
             echo "leeway_vulnerability_reports_dir=$scans_dir"
           } >> $GITHUB_OUTPUT
 
-          exit $RESULT
+          cat "$scans_dir/vulnerability-summary.md" >> $GITHUB_STEP_SUMMARY
       - name: Upload SBOMs
         uses: actions/upload-artifact@v4
         if: success()
         with:
           name: sboms
-          path: ${{ steps.leeway.outputs.leeway_sboms_dir }}
+          path: ${{ steps.scan.outputs.leeway_sboms_dir }}
       - name: Upload vulnerability reports
         uses: actions/upload-artifact@v4
         if: success()
         with:
           name: vulnerability-reports
-          path: ${{ steps.leeway.outputs.leeway_vulnerability_reports_dir }}
+          path: ${{ steps.scan.outputs.leeway_vulnerability_reports_dir }}
       - name: Tag the release
         if: github.ref == 'refs/heads/main'
         run: |