Run vulnerability scan on pull request

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

.github/workflows/make.yaml

@@ -72,3 +72,33 @@ jobs:
             coverage.html
           retention-days: 30
       - run: "make lint"
+
+  vulnerability-scan:
+    name: "vulnerability-scan"
+    runs-on: "ubuntu-24.04"
+    permissions:
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 0
+      - uses: "actions/setup-go@v5"
+        with:
+          go-version: "1.25"
+      - uses: "actions/setup-node@v4"
+        with:
+          node-version: 22
+      - run: "npm ci"
+      - name: "Install Syft"
+        uses: "anchore/sbom-action/download-syft@v0"
+      - name: "Install Grype"
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
+      - name: "Generate SBOM"
+        run: |
+          syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.sha }} > sbom.json
+      - name: "Scan SBOM for vulnerabilities"
+        run: |
+          echo "Scanning SBOM for vulnerabilities..."
+          grype sbom:sbom.json --fail-on critical --output table
+          echo "Vulnerability scan completed successfully - no critical vulnerabilities found"

.github/workflows/release.yaml

@@ -38,12 +38,11 @@ jobs:
         run: npm ci
 
       - name: Install Syft
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+        uses: anchore/sbom-action/download-syft@v0
 
       - name: Install Grype
         run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
@@ -74,7 +73,7 @@ jobs:
 
       - name: Generate SBOM for attestation
         run: |
-          syft dir:. --output cyclonedx-json --source-name probod --source-version ${{ github.ref_name }} > sbom.json
+          syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.ref_name }} > sbom.json
 
       - name: Scan SBOM for vulnerabilities
         run: |