Use official anchore github actions

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

.github/workflows/release.yaml

@@ -37,13 +37,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Install Syft
-        uses: anchore/sbom-action/download-syft@v0
-
-      - name: Install Grype
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
-
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
 
@@ -71,15 +64,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Generate SBOM for attestation
-        run: |
-          syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.ref_name }} > sbom.json
+      - name: Generate SBOM
+        uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
+        with:
+          path: ./
+          format: cyclonedx-json
+          output-file: sbom.json
 
-      - name: Scan SBOM for vulnerabilities
-        run: |
-          echo "Scanning SBOM for vulnerabilities..."
-          grype sbom:sbom.json --fail-on critical --output table
-          echo "Vulnerability scan completed successfully - no critical vulnerabilities found"
+      - name: Run vulnerability scan
+        uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
+        with:
+          path: ./
+          fail-build: true
+          severity-cutoff: critical
 
       - name: Generate subject for attestation
         id: hash