Use official anchore github actions

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

.github/workflows/make.yaml

@@ -29,7 +29,7 @@ jobs:
       - uses: "docker/setup-qemu-action@v3"
       - uses: "docker/setup-buildx-action@v3"
       - uses: "sigstore/cosign-installer@v3"
-      - uses: "anchore/sbom-action/download-syft@v0"
+      - uses: "anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c" # v0.20.5
       - uses: "goreleaser/goreleaser-action@v6"
         with:
           distribution: "goreleaser"
@@ -72,33 +72,16 @@ jobs:
             coverage.html
           retention-days: 30
       - run: "make lint"
+      - name: Generate SBOM
+        uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
+        with:
+          path: ./
+          format: cyclonedx-json
+          output-file: sbom.json
 
-  vulnerability-scan:
+      - name: Run vulnerability scan
-    name: "vulnerability-scan"
+        uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
-    runs-on: "ubuntu-24.04"
-    permissions:
-      contents: "read"
-    steps:
-      - uses: "actions/checkout@v4"
         with:
-          fetch-depth: 0
+          path: ./
-      - uses: "actions/setup-go@v5"
+          fail-build: true
-        with:
+          severity-cutoff: critical
-          go-version: "1.25"
-      - uses: "actions/setup-node@v4"
-        with:
-          node-version: 22
-      - run: "npm ci"
-      - name: "Install Syft"
-        uses: "anchore/sbom-action/download-syft@v0"
-      - name: "Install Grype"
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
-      - name: "Generate SBOM"
-        run: |
-          syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.sha }} > sbom.json
-      - name: "Scan SBOM for vulnerabilities"
-        run: |
-          echo "Scanning SBOM for vulnerabilities..."
-          grype sbom:sbom.json --fail-on critical --output table
-          echo "Vulnerability scan completed successfully - no critical vulnerabilities found"

.github/workflows/release.yaml

@@ -37,13 +37,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Install Syft
-        uses: anchore/sbom-action/download-syft@v0
-
-      - name: Install Grype
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
-
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
 
@@ -71,15 +64,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Generate SBOM for attestation
+      - name: Generate SBOM
-        run: |
+        uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
-          syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.ref_name }} > sbom.json
+        with:
+          path: ./
+          format: cyclonedx-json
+          output-file: sbom.json
 
-      - name: Scan SBOM for vulnerabilities
+      - name: Run vulnerability scan
-        run: |
+        uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
-          echo "Scanning SBOM for vulnerabilities..."
+        with:
-          grype sbom:sbom.json --fail-on critical --output table
+          path: ./
-          echo "Vulnerability scan completed successfully - no critical vulnerabilities found"
+          fail-build: true
+          severity-cutoff: critical
 
       - name: Generate subject for attestation
         id: hash

.grype.yaml

@@ -0,0 +1,5 @@
+ignore:
+  - vulnerability: "CVE-2024-3566"
+    package:
+      name: "stdlib"
+    reason: "CERT VU#123335: Go is Not Affected"

GNUmakefile

@@ -87,15 +87,15 @@ sbom:
 
 .PHONY: scan-sbom
 scan-sbom: sbom
-	$(GRYPE) sbom:sbom.json --fail-on high
+	$(GRYPE) sbom:sbom.json --config .grype.yaml --fail-on high
 
 .PHONY: scan-sbom-docker
 scan-sbom-docker: sbom-docker
-	$(GRYPE) sbom:sbom-docker.json --fail-on high
+	$(GRYPE) sbom:sbom-docker.json --config .grype.yaml --fail-on high
 
 .PHONY: scan-docker
 scan-docker: docker-build
-	$(GRYPE) docker:$(DOCKER_IMAGE_NAME):$(DOCKER_TAG_NAME) --fail-on high
+	$(GRYPE) docker:$(DOCKER_IMAGE_NAME):$(DOCKER_TAG_NAME) --config .grype.yaml --fail-on high
 
 .PHONY: scan
 scan: scan-sbom scan-sbom-docker scan-docker