chore: Add SBOM vulnerability scans BED-8648

[ykaiboussiSO]

Description

This change adds pull-request vulnerability scanning by generating an SPDX JSON SBOM with syft and scanning it using grype for critical CVEs.

Motivation and Context

Resolves BED-8648

How Has This Been Tested?

Successful GH workflow execution

Screenshots (optional):

Types of changes

• Chore (a change that does not modify the application functionality)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Database Migrations

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README #672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

Summary by CodeRabbit

• New Features
  • Added an automated “Vulnerability Scan” workflow for pull requests targeting main and stage/**.
  • Generates an SPDX JSON SBOM and scans it, reporting only fixed issues above a high severity cutoff.
  • Excludes node_modules from vulnerability analysis via the scan configuration.
  • Updated the vulnerability scanning configuration to include an ignore section (with a commented example).

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a new pull request workflow that generates an SPDX JSON SBOM, scans it for high-severity fixed CVEs, and prints scan output on failure. Also adds Syft and Grype configuration files.

Changes

Vulnerability scanning setup

Layer / File(s)	Summary
Workflow trigger and permissions .github/workflows/vulnerability-scans.yml	Defines the pull request trigger, read-only contents permission, and scan job.
SBOM generation and Syft config .github/workflows/vulnerability-scans.yml, .syft.yaml	Checks out the repository, generates an SPDX JSON SBOM with anchore/sbom-action, and applies the Syft exclusion for ./node_modules/**.
SBOM scan and output .github/workflows/vulnerability-scans.yml, .grype.yaml	Scans the SBOM with anchore/scan-action, filters for fixed high-severity CVEs, writes table output to /tmp/output, prints that output on failure, and adds a Grype ignore entry stub.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: adding SBOM-based vulnerability scans for pull requests.
Description check	✅ Passed	The description covers the required sections, references the ticket, and includes testing and checklist details.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch BED-8648

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/workflows/vulnerability-scans.yml (1)

30-31: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

No timeout-minutes set on the job.

If sbom-action/scan-action hang (e.g. on DB download), the job falls back to GitHub's default 6-hour timeout, wasting runner minutes. Consider adding an explicit timeout-minutes bound.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/vulnerability-scans.yml around lines 30 - 31, The scan job
is missing an explicit timeout, so add a bounded timeout to the scan-sbom-file
job in the vulnerability-scans workflow. Update the job definition alongside
runs-on by setting timeout-minutes on scan-sbom-file to prevent sbom-action or
scan-action from hanging indefinitely.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/vulnerability-scans.yml:
- Around line 33-34: Add persist-credentials: false to the actions/checkout step
in the vulnerability-scans workflow so the GITHUB_TOKEN is not left in git
config. Update the checkout job entry identified by the actions/checkout step in
the workflow to explicitly disable credential persistence.
- Around line 29-34: The vulnerability-scans workflow is missing an explicit
permissions scope, so `GITHUB_TOKEN` may be broader than needed. Update the
workflow around `scan-sbom-file` to add a minimal `permissions` block at the
workflow or job level, keeping only the access required for `actions/checkout`
and the local scan steps. Use the existing job name and checkout step as the
anchor when making the change.

---

Nitpick comments:
In @.github/workflows/vulnerability-scans.yml:
- Around line 30-31: The scan job is missing an explicit timeout, so add a
bounded timeout to the scan-sbom-file job in the vulnerability-scans workflow.
Update the job definition alongside runs-on by setting timeout-minutes on
scan-sbom-file to prevent sbom-action or scan-action from hanging indefinitely.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: bf35add8-5324-4057-b556-15eb51189f43

📥 Commits

Reviewing files that changed from the base of the PR and between aa6e331 and a6c2b8a.

📒 Files selected for processing (2)

• .github/workflows/vulnerability-scans.yml
• .syft.yaml