Update vulnerability-scan.yml

Author: swmal

.github/workflows/vulnerability-scan.yml

@@ -28,6 +28,33 @@ jobs:
         echo "SBOM index fetched:"
         cat all.json
 
+    - name: Get grype version
+      id: grype_version
+      run: |
+        GRYPE_VERSION=$(grype version -o json | jq -r '.version')
+        echo "GRYPE_VERSION=$GRYPE_VERSION" >> $GITHUB_ENV
+        echo "Grype version: $GRYPE_VERSION"
+
+    - name: Start scan
+      id: start_scan
+      run: |
+        SCAN_GUID=$(uuidgen)
+        echo "SCAN_GUID=$SCAN_GUID" >> $GITHUB_ENV
+
+        response=$(curl -s -o start_response.json -w "%{http_code}" \
+          -X POST "https://epplussoftware.com/api/security/vulnerability/scan/start?scanId=${SCAN_GUID}&grypeVersion=${GRYPE_VERSION}" \
+          -H "X-Api-Key: ${{ secrets.EPPLUS_VULNERABILITY_API_KEY }}")
+
+        if [ "$response" != "200" ]; then
+          echo "ERROR: Failed to start scan with HTTP $response"
+          cat start_response.json
+          exit 1
+        fi
+
+        SCAN_DB_ID=$(jq -r '.scanDbId' start_response.json)
+        echo "SCAN_DB_ID=$SCAN_DB_ID" >> $GITHUB_ENV
+        echo "Scan started: GUID=$SCAN_GUID, DB ID=$SCAN_DB_ID"
+
     - name: Scan each SBOM
       shell: bash
       run: |
@@ -135,7 +162,7 @@ jobs:
 
               echo "--- Indexing EPPlus $version / $tfm ---"
               response=$(curl -s -o response.json -w "%{http_code}" \
-                -X POST "https://epplussoftware.com/api/security/vulnerability/index/${version}?tfm=${tfm}" \
+                -X POST "https://epplussoftware.com/api/security/vulnerability/index/${version}?tfm=${tfm}&scanId=${SCAN_DB_ID}" \
                 -H "X-Api-Key: ${{ secrets.EPPLUS_VULNERABILITY_API_KEY }}" \
                 -H "Content-Type: application/json" \
                 -d @"./reports/${version}/${tfm}/report.json")
@@ -152,7 +179,7 @@ jobs:
           else
             echo "--- Indexing EPPlus $version (combined) ---"
             response=$(curl -s -o response.json -w "%{http_code}" \
-              -X POST "https://epplussoftware.com/api/security/vulnerability/index/${version}" \
+              -X POST "https://epplussoftware.com/api/security/vulnerability/index/${version}?scanId=${SCAN_DB_ID}" \
               -H "X-Api-Key: ${{ secrets.EPPLUS_VULNERABILITY_API_KEY }}" \
               -H "Content-Type: application/json" \
               -d @"./reports/${version}/report.json")
@@ -167,3 +194,17 @@ jobs:
             cat response.json
           fi
         done
+
+    - name: Complete scan (success)
+      if: success()
+      run: |
+        curl -s -X POST "https://epplussoftware.com/api/security/vulnerability/scan/complete?scanId=${SCAN_GUID}&status=completed" \
+          -H "X-Api-Key: ${{ secrets.EPPLUS_VULNERABILITY_API_KEY }}"
+        echo "Scan marked as completed"
+
+    - name: Complete scan (failure)
+      if: failure() && env.SCAN_GUID != ''
+      run: |
+        curl -s -X POST "https://epplussoftware.com/api/security/vulnerability/scan/complete?scanId=${SCAN_GUID}&status=failed" \
+          -H "X-Api-Key: ${{ secrets.EPPLUS_VULNERABILITY_API_KEY }}"
+        echo "Scan marked as failed"