[CRAVEX] SCA Integrations: Trivy #1

	name: Generate SBOM with Trivy and load in ScanCode.io

	on:
	workflow_dispatch:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	env:
	IMAGE_REFERENCE: "python:3.13.0-slim"

	jobs:
	generate-and-load-sbom:
	runs-on: ubuntu-24.04
	steps:
	- name: Run Trivy in CycloneDX SBOM mode
	uses: aquasecurity/trivy-action@0.32.0
	with:
	scan-type: "image"
	image-ref: ${{ env.IMAGE_REFERENCE }}
	format: "cyclonedx"
	output: "trivy-report.sbom.json"
	scanners: "vuln,license"
	version: "latest"

	- name: Upload Trivy SBOM as a Github artifact
	uses: actions/upload-artifact@v4
	with:
	name: upload-trivy-sbom-report
	path: "${{ github.workspace }}/trivy-report.sbom.json"
	retention-days: 20

	- name: Load the Trivy SBOM into ScanCode.io
	uses: aboutcode-org/scancode-action@file-as-inputs-path
	with:
	pipelines: "load_sbom"
	inputs-path: "${{ github.workspace }}/trivy-report.sbom.json"

	- name: Check the SBOM was properly loaded in ScanCode.io
	shell: bash
	run: \|
	scanpipe shell --command "from scanpipe.models import DiscoveredPackage; package_manager = DiscoveredPackage.objects; assert package_manager.count() > 90; assert package_manager.vulnerable().count() > 40;"

Provide feedback