From 94152251b59acd4c30acc7ed5989ad0f315176bc Mon Sep 17 00:00:00 2001 From: Wikid82 Date: Thu, 27 Aug 2026 21:27:00 -0400 Subject: [PATCH] ci: scan image with Grype directly instead of via SBOM file handoff anchore/sbom-action v0.24.1 stopped writing its SBOM into the workspace at the `output-file` path (it now only lands in a temp dir), so the "Scan SBOM for vulnerabilities (Grype)" step failed the merge job with "unable to decode sbom: sbom format not recognized" and the standalone "Upload SBOM artifact" step had no file to upload. Point Grype at the pushed image digest directly, the same way the Trivy steps already do, so the vuln scan no longer depends on a file produced by a different action. Drop the separate upload-artifact step and let sbom-action upload the SBOM itself (it also attaches it to the GitHub Release on release events), naming it sbom-.cyclonedx.json. --- .github/workflows/docker-build.yml | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index b91cdac..ea8b034 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -276,18 +276,28 @@ jobs: sarif_file: trivy-results.sarif category: trivy-image-scan + # anchore/sbom-action uploads the SBOM it generates as a workflow + # artifact itself (and attaches it to the GitHub Release on release + # events), so there is no separate upload-artifact step. Grype below + # scans the pushed image directly rather than consuming this SBOM + # file: sbom-action's `output-file` input only reliably writes to a + # temp dir (v0.24.1 stopped writing it into the workspace at all), + # and chaining the two tools through an on-disk file that a patch + # bump can silently relocate is exactly what broke this job. Both + # scanners now take the image digest independently, like the Trivy + # steps above. - name: Generate SBOM uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 with: image: ${{ env.REGISTRY_IMAGE }}@${{ steps.scan.outputs.digest }} format: cyclonedx-json - output-file: sbom.cyclonedx.json + artifact-name: sbom-${{ github.sha }}.cyclonedx.json - - name: Scan SBOM for vulnerabilities (Grype) + - name: Scan image for vulnerabilities (Grype) id: grype uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7 with: - sbom: sbom.cyclonedx.json + image: ${{ env.REGISTRY_IMAGE }}@${{ steps.scan.outputs.digest }} output-format: sarif severity-cutoff: high fail-build: false @@ -298,10 +308,3 @@ jobs: with: sarif_file: ${{ steps.grype.outputs.sarif }} category: supply-chain-sbom - - - name: Upload SBOM artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: sbom-${{ github.sha }} - path: sbom.cyclonedx.json - retention-days: 30