Create sbom-anchore-syft.yml #17

	name: Docker Image CI with Trivy Security Report

	on:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]

	jobs:
	build:
	runs-on: ubuntu-latest

	env:
	IMAGE_TAG: ${{ github.run_id }}

	steps:
	- uses: actions/checkout@v3

	- name: Build the Docker image
	run: \|
	docker build . --file Dockerfile --tag name-convention-generator:${IMAGE_TAG}

	- name: Set up Trivy
	run: \|
	sudo apt-get update
	sudo apt-get install -y wget
	wget https://github.com/aquasecurity/trivy/releases/download/v0.40.0/trivy_0.40.0_Linux-64bit.deb
	sudo dpkg -i trivy_0.40.0_Linux-64bit.deb
	trivy --version

	- name: Scan Docker image with Trivy and generate SARIF
	run: \|
	mkdir -p trivy-reports
	trivy image name-convention-generator:${IMAGE_TAG} \
	--format sarif \
	--output trivy-reports/trivy-report.sarif \
	--severity HIGH,CRITICAL

	- name: Upload SARIF file to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: trivy-reports/trivy-report.sarif

Provide feedback