From 55794631eed667af94e2878a58ba0b7d6d0bfb07 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Wed, 3 Dec 2025 11:40:36 +0100
Subject: [PATCH] Fix output and sarif upload trivy

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 .github/workflows/make.yaml    | 37 +++++++++++++++++++++++-----------
 .github/workflows/release.yaml | 18 +++++++++++++++++
 2 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml
index 7a119908d..3c5545af3 100644
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -38,19 +38,43 @@ jobs:
           args: "release --clean --snapshot"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: "aquasecurity/trivy-action@0.28.0"
+      - name: Scan Docker image with Trivy
+        if: github.ref == 'refs/heads/main'
+        uses: "aquasecurity/trivy-action@0.28.0"
         with:
           image-ref: "ghcr.io/getprobo/probo:latest-amd64"
           format: "sarif"
           output: "trivy-results.sarif"
+          exit-code: 0
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
+      - name: Scan Docker image with Trivy
+        if: github.ref != 'refs/heads/main'
+        uses: "aquasecurity/trivy-action@0.28.0"
+        with:
+          image-ref: "ghcr.io/getprobo/probo:latest-amd64"
+          format: "table"
           exit-code: 1
           ignore-unfixed: true
           vuln-type: "os,library"
           severity: "CRITICAL,HIGH"
       - name: Upload Trivy scan results to GitHub Security tab
+        if: github.ref == 'refs/heads/main'
         uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: "trivy-results.sarif"
+      - uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
+        with:
+          path: ./
+          format: cyclonedx-json
+          output-file: sbom.json
+      - uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
+        with:
+          path: ./
+          fail-build: true
+          severity-cutoff: critical
+          output-format: table
 
   test:
     name: "test"
@@ -77,17 +101,6 @@ jobs:
             coverage.html
           retention-days: 30
       - run: "make lint"
-      - uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
-        with:
-          path: ./
-          format: cyclonedx-json
-          output-file: sbom.json
-      - uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
-        with:
-          path: ./
-          fail-build: true
-          severity-cutoff: critical
-          output-format: table
 
   test-e2e:
     name: "test-e2e"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 481031962..885ac46c5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,6 +10,7 @@ permissions:
   packages: write
   id-token: write
   attestations: write
+  security-events: write
 
 jobs:
   github-release:
@@ -64,6 +65,23 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Scan Docker image with Trivy
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          image-ref: "ghcr.io/getprobo/probo:${{ github.ref_name }}"
+          format: "sarif"
+          output: "trivy-results.sarif"
+          exit-code: 1
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-results.sarif"
+
       - name: Generate SBOM
         uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
         with: