Bump anchore/sbom-action from 0.19.0 to 0.20.0 #112

	# https://trivy.dev/latest/
	# https://github.com/aquasecurity/trivy
	# https://github.com/aquasecurity/trivy-action

	name: CIS - Trivy Container Image Scanning

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: 0 1 * * 0

	env:
	imageName: "webapp01"
	tag: ${{ github.sha }}

	permissions:
	contents: read # for actions/checkout to fetch code
	id-token: write
	security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
	actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

	jobs:
	trivy:
	name: Trivy vulnerability scanner

	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Build an image from Dockerfile
	run: \|
	docker build ./src/webapp01 --file ./src/webapp01/Dockerfile --tag ${{ env.imageName }}:${{ env.tag }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/[email protected]
	with:
	image-ref: "${{ env.imageName }}:${{ env.tag }}"
	format: "sarif"
	output: "trivy-results.sarif"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	if: always()
	with:
	sarif_file: "trivy-results.sarif"

	- name: Upload alerts file as a workflow artifact
	uses: actions/upload-artifact@v4
	with:
	name: alerts
	path: "trivy-results.sarif"

Provide feedback