[DPE-5585] SBOM Generation #53

	name: Trivy Security Scanner
	on:
	push:
	branches:
	- 3-22.04
	pull_request:
	jobs:
	build:
	uses: ./.github/workflows/build.yaml
	scan:
	name: Trivy scan and SBOM generation
	needs: build
	runs-on: ubuntu-20.04
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Install rockcraft (for skopeo)
	run: \|
	sudo snap install rockcraft --classic --edge
	- name: Download artifact
	uses: actions/download-artifact@v3
	with:
	name: charmed-kafka
	- name: Import locally
	run: \|
	sudo rockcraft.skopeo --insecure-policy copy \
	oci-archive:${{ needs.build.outputs.rock }} \
	docker-daemon:trivy/charmed-kafka:test

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: 'trivy/charmed-kafka:test'
	format: 'sarif'
	output: 'trivy-results.sarif'
	severity: 'MEDIUM,HIGH,CRITICAL'

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v2
	if: always()
	with:
	sarif_file: 'trivy-results.sarif'

	- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
	uses: aquasecurity/[email protected]
	with:
	scan-type: 'image'
	format: 'spdx-json'
	output: 'dependency-results.sbom.json'
	image-ref: 'trivy/charmed-kafka:test'
	github-pat: ${{ secrets.GITHUB_TOKEN }}
	severity: "MEDIUM,HIGH,CRITICAL"
	scanners: "vuln"

	- name: Upload trivy report as a Github artifact
	uses: actions/upload-artifact@v4
	with:
	name: trivy-sbom-report
	path: '${{ github.workspace }}/dependency-results.sbom.json'
	retention-days: 90

Provide feedback