From 4ee00435b934a3e4f5cc57c345ceeffbe57cb5bf Mon Sep 17 00:00:00 2001
From: Enrico Deusebio <enrico.deusebio@canonical.com>
Date: Tue, 1 Oct 2024 11:38:25 +0200
Subject: [PATCH] [DPE-5586] SBOM Generation

---
 .github/workflows/trivy.yaml | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
index 4c9a41a..85a56cd 100644
--- a/.github/workflows/trivy.yaml
+++ b/.github/workflows/trivy.yaml
@@ -8,12 +8,12 @@ jobs:
   build:
     uses: ./.github/workflows/build.yaml
   scan:
-    name: Trivy scan
+    name: Trivy scan and SBOM generation
     needs: build
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Install dependencies
         run: |
           sudo snap install rockcraft --classic --edge
@@ -39,3 +39,22 @@ jobs:
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
+
+      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
+        uses: aquasecurity/trivy-action@0.20.0
+        with:
+          scan-type: 'image'
+          format: 'spdx-json'
+          output: 'dependency-results.sbom.json'
+          image-ref: 'trivy/charmed-zookeeper:test'
+          github-pat: ${{ secrets.GITHUB_TOKEN }}
+          severity: "MEDIUM,HIGH,CRITICAL"
+          scanners: "vuln"
+
+      - name: Upload trivy report as a Github artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-sbom-report
+          path: '${{ github.workspace }}/dependency-results.sbom.json'
+          retention-days: 90
+