CRAVEX-integration: Integration with SCA Tools: Anchore

[pombredanne]

Integrate and import Anchore results

[tdruez]

Implemented at #1820

This PR adds support for importing SBOMs generated with Anchore tools.

Changes:

• Adapt the load_sbom pipeline to ensure the Anchore SBOMs are fully supported
• Add a unit test to ensure the Anchore SBOM support
• Add a GitHub workflow that runs every week to ensure the Anchore SBOM support (see below for details)

Workflow

Available at .github/workflows/sca-integration-anchore.yml

Documentation:

# This workflow:
#  1. Generates a CycloneDX SBOM for a container image using Anchore Grype.
#  2. Uploads the SBOM as a GitHub artifact for future inspection.
#  3. Loads the SBOM into ScanCode.io for further analysis.
#  4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
#
# It runs on demand, and once a week (scheduled).

Notes

The Grype scan-action is used in the workflow to generate an SBOM that also includes vulnerabilities.