Download syft in a separate step

Author: ciarams87

.github/workflows/build.yml

@@ -160,20 +160,15 @@ jobs:
             ${{ contains(inputs.image, 'plus') && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
             ${{ contains(inputs.image, 'plus') && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}
 
+      - name: Download Syft
+        uses: anchore/sbom-action/download-syft@cee1b8e05ae5b2593a75e197229729eabaa9f8ec # v0.20.2
+        if: ${{ inputs.image == 'plus-waf' }}
+
       - name: Inspect SBOM and output manifest
         run: |
           if [[ "${{ inputs.image }}" == "plus-waf" ]]; then
           # For plus-waf, use syft directly
-          echo "Generating SBOM for plus-waf using syft..."
-
-          # Install syft if not available
-          if ! command -v syft >/dev/null 2>&1; then
-          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
-          fi
-
-          # Generate SBOM using syft directly for plus-waf (known to work with NAP WAF)
           syft localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} -o spdx-json > sbom-${{ inputs.image }}.json
-          echo "Generated SBOM using syft for plus-waf"
           else
           # For other images, use the standard Docker buildx approach
           docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-${{ inputs.image }}.json

README.md

@@ -68,7 +68,7 @@ The following table lists the software versions NGINX Gateway Fabric supports.
 
 | NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus | NGINX Agent | NGINX NAP WAF |
 |----------------------|-------------|------------|-----------|------------|-------------|---------------|
-| Edge                 | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.3      | 5.7.0.        |
+| Edge                 | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.3      | 5.7.0         |
 | 2.0.2                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.1      | ---           |
 | 2.0.1                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.1      | ---           |
 | 2.0.0                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.0      | ---           |