From 7a369c8062c16328728d545343d342e875c40019 Mon Sep 17 00:00:00 2001
From: gcaracuel <633810+gcaracuel@users.noreply.github.com>
Date: Mon, 12 Jun 2023 08:33:33 +0200
Subject: [PATCH] Adds SBOM creation and build for ARM

---
 .github/workflows/docker.yaml | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index fb8d7257..9f20850b 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -5,8 +5,7 @@ on:
     tags:
       - '*'
     branches:
-      - main
-      - master
+      - '*'
 
 env:
   REGISTRY: ghcr.io
@@ -42,5 +41,16 @@ jobs:
           context: .
           file: src/Dockerfile
           push: true
+          sbom: true
+          platforms: linux/amd64,linux/arm64
+          provenance: true
           tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
\ No newline at end of file
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Scan SBOM
+        uses: anchore/scan-action@v3
+        with:
+          sbom: "sbom.spdx.json"
+          # fail-build: true
+          # severity-cutoff: critical
+          fail-build: false
\ No newline at end of file