Use SHA for signing and do not upload SBOM as part of docker release/build (#12)

Signed-off-by: Erick Bourgeois <erick@jeb.ca>

Author: ebourgeois

.github/actions/extract-version/action.yml

@@ -35,7 +35,7 @@ outputs:
     description: 'Git tag name (e.g., v1.2.3)'
     value: ${{ steps.extract.outputs.tag-name }}
   image-tag:
-    description: 'Docker image tag (e.g., main-2025.12.17, pr-42, v0.2.0)'
+    description: 'Docker image tag (e.g., main-2025-12-17, pr-42, v0.2.0)'
     value: ${{ steps.extract.outputs.image-tag }}
   image-repository:
     description: 'Docker repository name (e.g., finos/myapp)'
@@ -85,9 +85,9 @@ runs:
             ;;
 
           main)
-            # Main branch: use main-YYYY.MM.DD format
-            # Tag format: main-2025.12.17
-            DATE=$(date +%Y.%m.%d)
+            # Main branch: use main-YYYY-MM-DD format
+            # Tag format: main-2025-12-17
+            DATE=$(date +%Y-%m-%d)
             VERSION="0.0.0-main.${DATE}.${{ github.run_number }}"
             TAG_NAME="main-${DATE}"
             IMAGE_TAG="main-${DATE}${IMAGE_TAG_SUFFIX}"

.github/workflows/build.yaml

@@ -496,6 +496,11 @@ jobs:
     name: 🔭 Container Security Scan - ${{ matrix.variant.name }}
     runs-on: ubuntu-latest
     needs: [docker, extract-version]
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+      security-events: write
     strategy:
       fail-fast: false
       matrix:
@@ -510,6 +515,13 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run Trivy scan on ${{ matrix.variant.name }} image
         uses: firestoned/github-actions/security/trivy-scan@v1.3.6
         with: