chore: propagate main into development

.github/workflows/docker-build.yml

@@ -276,18 +276,28 @@ jobs:
           sarif_file: trivy-results.sarif
           category: trivy-image-scan
 
+      # anchore/sbom-action uploads the SBOM it generates as a workflow
+      # artifact itself (and attaches it to the GitHub Release on release
+      # events), so there is no separate upload-artifact step. Grype below
+      # scans the pushed image directly rather than consuming this SBOM
+      # file: sbom-action's `output-file` input only reliably writes to a
+      # temp dir (v0.24.1 stopped writing it into the workspace at all),
+      # and chaining the two tools through an on-disk file that a patch
+      # bump can silently relocate is exactly what broke this job. Both
+      # scanners now take the image digest independently, like the Trivy
+      # steps above.
       - name: Generate SBOM
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
           image: ${{ env.REGISTRY_IMAGE }}@${{ steps.scan.outputs.digest }}
           format: cyclonedx-json
-          output-file: sbom.cyclonedx.json
+          artifact-name: sbom-${{ github.sha }}.cyclonedx.json
 
-      - name: Scan SBOM for vulnerabilities (Grype)
+      - name: Scan image for vulnerabilities (Grype)
         id: grype
         uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7
         with:
-          sbom: sbom.cyclonedx.json
+          image: ${{ env.REGISTRY_IMAGE }}@${{ steps.scan.outputs.digest }}
           output-format: sarif
           severity-cutoff: high
           fail-build: false
@@ -298,10 +308,3 @@ jobs:
         with:
           sarif_file: ${{ steps.grype.outputs.sarif }}
           category: supply-chain-sbom
-
-      - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: sbom-${{ github.sha }}
-          path: sbom.cyclonedx.json
-          retention-days: 30