From b99c2b0ef273ccfa715be09524aa0c6953b51583 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Mon, 14 Jul 2025 17:20:03 +0200 Subject: [PATCH] Block release when critial vulnerabilities founded in deps Signed-off-by: Bryan Frimin --- .github/workflows/release.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 94b6f70d6..3ab344927 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -41,6 +41,10 @@ jobs: run: | curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin + - name: Install Grype + run: | + curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin + - name: Install Cosign uses: sigstore/cosign-installer@v3 @@ -72,6 +76,12 @@ jobs: run: | syft dir:. --output cyclonedx-json --source-name probod --source-version ${{ github.ref_name }} > sbom.json + - name: Scan SBOM for vulnerabilities + run: | + echo "Scanning SBOM for vulnerabilities..." + grype sbom:sbom.json --fail-on critical --output table + echo "Vulnerability scan completed successfully - no critical vulnerabilities found" + - name: Generate subject for attestation id: hash run: |