Main to dev (#196)

* Create SBOM files (#173)

* CI sbom implementation

* uncomment build-binaries job

* run sbom on self-hosted workers

* use shogo82148/actions-upload-release-asset upload action

* CI: scan code with trivy (#174)

* CI: scan code with trivy

* bump trivy action version

* include low severity vulns in sbom

* Periodic sbom regeneration (#176)

* periodic sbom and advisories regeneration

* fix advisories upload

* remove branch push trigger

* only generate sbom for full releases

---------

Co-authored-by: Jacek Chmielewski <jchmielewski@teonite.com>
Co-authored-by: Jacek Chmielewski <jacek@defguard.net>

Author: filipslezaklab

.github/workflows/sbom-regenerate.yml

@@ -17,7 +17,9 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           RELEASES_JSON=$(gh api repos/${{ github.repository }}/releases \
-            --jq '[.[] | select(.draft == false) | {tagName: .tag_name, uploadUrl: .upload_url}][:1]')
+            --jq '[.[]
+                   | select(.draft == false and (.tag_name | test("^v[0-9]+\\.[0-9]+\\.[0-9]+$")))
+                   | {tagName: .tag_name, uploadUrl: .upload_url}][:1]')
           echo "releases=$RELEASES_JSON" >> $GITHUB_OUTPUT
   regenerate-for-release:
     name: Regenerate SBOM for release