From 1fde5cc1d0fcf30ba9d9dc7fa5afce2938140f6a Mon Sep 17 00:00:00 2001 From: Christian Peper Date: Mon, 6 Jul 2026 15:06:40 +0200 Subject: [PATCH 1/6] feat(ci): create SBOM for the Dockerfile add an SBOM using syft of the container image just built and scan the SBOM for vulns. --- .github/workflows/docker-image.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 8e17d0c..d729558 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -16,3 +16,9 @@ jobs: - uses: actions/checkout@v4 - name: Build the Docker image run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) + - name: Scan the image and upload dependency results + uses: anchore/sbom-action@bb716408e75840bbb01e839347cd213767269d4a + with: + image: "dev-opentofu:$(date +%s)" + artifact-name: image.spdx.json + dependency-snapshot: true From 2c9653dc2b494f3ce3d61075fe01b8d43c7f7be6 Mon Sep 17 00:00:00 2001 From: Christian Peper Date: Mon, 6 Jul 2026 15:24:24 +0200 Subject: [PATCH 2/6] fix(ci): change version of GHA --- .github/workflows/docker-image.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index d729558..10e09de 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -17,7 +17,7 @@ jobs: - name: Build the Docker image run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) - name: Scan the image and upload dependency results - uses: anchore/sbom-action@bb716408e75840bbb01e839347cd213767269d4a + uses: anchore/sbom-action@0.24.0 with: image: "dev-opentofu:$(date +%s)" artifact-name: image.spdx.json From 0bc51bee9c5ea3bc8fa4d3e6ad12d15775b3f51d Mon Sep 17 00:00:00 2001 From: Christian Peper Date: Mon, 6 Jul 2026 15:25:31 +0200 Subject: [PATCH 3/6] fix(ci): change version of syft GHA --- .github/workflows/docker-image.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 10e09de..8ebbd47 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -17,7 +17,7 @@ jobs: - name: Build the Docker image run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) - name: Scan the image and upload dependency results - uses: anchore/sbom-action@0.24.0 + uses: anchore/sbom-action@0 with: image: "dev-opentofu:$(date +%s)" artifact-name: image.spdx.json From fb1b6ab0ea5e7f2b2317faa6b2158ed43d0643a3 Mon Sep 17 00:00:00 2001 From: Christian Peper Date: Mon, 6 Jul 2026 15:46:39 +0200 Subject: [PATCH 4/6] fix(ci): use latest SHA digest for GHA --- .github/workflows/docker-image.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 8ebbd47..12b1f6d 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -17,7 +17,7 @@ jobs: - name: Build the Docker image run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) - name: Scan the image and upload dependency results - uses: anchore/sbom-action@0 + uses: anchore/sbom-action@66ac98262c0ea26e56fc8736d198020a6ea5a2fd with: image: "dev-opentofu:$(date +%s)" artifact-name: image.spdx.json From d43aa304b1956b4882dcc7e275bbd5b50cfc6e2d Mon Sep 17 00:00:00 2001 From: Christian Peper Date: Mon, 6 Jul 2026 15:51:27 +0200 Subject: [PATCH 5/6] fix(ci): use this digest for syft --- .github/workflows/docker-image.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 12b1f6d..c1c6d68 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -17,7 +17,7 @@ jobs: - name: Build the Docker image run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) - name: Scan the image and upload dependency results - uses: anchore/sbom-action@66ac98262c0ea26e56fc8736d198020a6ea5a2fd + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 with: image: "dev-opentofu:$(date +%s)" artifact-name: image.spdx.json From 246d23d557094ef45d1f96eea6fa068819638a6d Mon Sep 17 00:00:00 2001 From: Christian Peper Date: Mon, 6 Jul 2026 15:54:27 +0200 Subject: [PATCH 6/6] fix(ci): tag container also as latest and scan that tag --- .github/workflows/docker-image.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index c1c6d68..13edb83 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -15,10 +15,10 @@ jobs: steps: - uses: actions/checkout@v4 - name: Build the Docker image - run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) + run: docker build . --file dev-opentofu/.devcontainer/Dockerfile --tag dev-opentofu:$(date +%s) --tag dev-opentofu:latest - name: Scan the image and upload dependency results uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 with: - image: "dev-opentofu:$(date +%s)" + image: "dev-opentofu:latest" artifact-name: image.spdx.json dependency-snapshot: true