test: add unit tests for cve-diff and fallback for in-build sbom scans

action.yaml

@@ -168,6 +168,7 @@ runs:
           docker buildx imagetools inspect "${{ inputs.head-image }}" \
             --format "{{ json (index .SBOM \"${platform}\").SPDX }}" > "sboms/head/sbom-${arch_tag}.spdx.json" 2>/dev/null || true
           cleanup_file "sboms/head/sbom-${arch_tag}.spdx.json"
+          [ -f "sboms/head/sbom-${arch_tag}.spdx.json" ] && cp "sboms/head/sbom-${arch_tag}.spdx.json" "sboms/head/inbuild-sbom-${arch_tag}.spdx.json" 2>/dev/null || true
         fi
 
         if [ ! -f "sboms/head/sbom-${arch_tag}.spdx.json" ]; then
@@ -184,6 +185,7 @@ runs:
           docker buildx imagetools inspect "${{ inputs.target-image }}" \
             --format "{{ json (index .SBOM \"${platform}\").SPDX }}" > "sboms/target/sbom-${arch_tag}.spdx.json" 2>/dev/null || true
           cleanup_file "sboms/target/sbom-${arch_tag}.spdx.json"
+          [ -f "sboms/target/sbom-${arch_tag}.spdx.json" ] && cp "sboms/target/sbom-${arch_tag}.spdx.json" "sboms/target/inbuild-sbom-${arch_tag}.spdx.json" 2>/dev/null || true
         fi
 
         if [ ! -f "sboms/target/sbom-${arch_tag}.spdx.json" ]; then
@@ -201,6 +203,7 @@ runs:
           docker buildx imagetools inspect "${{ inputs.head-image }}" \
             --format '{{ json .SBOM.SPDX }}' > sboms/head/sbom-default.spdx.json 2>/dev/null || true
           cleanup_file sboms/head/sbom-default.spdx.json
+          [ -f sboms/head/sbom-default.spdx.json ] && cp sboms/head/sbom-default.spdx.json sboms/head/inbuild-sbom-default.spdx.json 2>/dev/null || true
         fi
 
         if [ ! -f sboms/head/sbom-default.spdx.json ]; then
@@ -217,6 +220,7 @@ runs:
           docker buildx imagetools inspect "${{ inputs.target-image }}" \
             --format '{{ json .SBOM.SPDX }}' > sboms/target/sbom-default.spdx.json 2>/dev/null || true
           cleanup_file sboms/target/sbom-default.spdx.json
+          [ -f sboms/target/sbom-default.spdx.json ] && cp sboms/target/sbom-default.spdx.json sboms/target/inbuild-sbom-default.spdx.json 2>/dev/null || true
         fi
 
         if [ ! -f sboms/target/sbom-default.spdx.json ]; then
@@ -304,6 +308,7 @@ runs:
 
       head_summary=()
       target_summary=()
+      use_inbuild="${{ inputs.use-inbuild-sbom }}"
 
       # 1. Scan Head SBOMs
       if [ ${#head_sboms[@]} -eq 0 ]; then
@@ -316,9 +321,40 @@ runs:
           err_log="cve-reports/head/cve-${arch}.err"
 
           echo "Scanning head SBOM for architecture: $arch"
+          scan_success=false
           if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+            scan_success=true
+          fi
+
+          vuln_cnt=0
+          if [ -s "$out_json" ]; then
+            cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
+            cnt=$(echo "$cnt" | tr -d '[:space:]')
+            [ -n "$cnt" ] && vuln_cnt="$cnt"
+          fi
+
+          # Fallback if in-build SBOM scan produced 0 CVEs (e.g. incompatible third-party format) or scan failed
+          if [ "$use_inbuild" = "true" ] && { [ "$scan_success" != "true" ] || [ "$vuln_cnt" -eq 0 ]; }; then
+            echo "::warning::In-build SBOM for head image (${arch}) yielded ${vuln_cnt} CVE findings. Falling back to direct Trivy image scan..."
+            t_plat="linux/${arch}"
+            [ "$arch" = "default" ] && t_plat=""
+            plat_arg=""
+            [ -n "$t_plat" ] && plat_arg="--platform $t_plat"
+            if trivy image --skip-version-check $plat_arg --format spdx-json --output "$f" "${{ inputs.head-image }}"; then
+              echo "Re-scanning head SBOM generated directly by Trivy..."
+              if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+                scan_success=true
+                if [ -s "$out_json" ]; then
+                  cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
+                  cnt=$(echo "$cnt" | tr -d '[:space:]')
+                  [ -n "$cnt" ] && vuln_cnt="$cnt"
+                fi
+              fi
+            fi
+          fi
+
+          if [ "$scan_success" = "true" ]; then
             if [ -s "$out_json" ]; then
-              vuln_cnt=$(grep -o '"VulnerabilityID"' "$out_json" 2>/dev/null | wc -l || echo 0)
               if [ "$vuln_cnt" -eq 0 ]; then
                 echo "::warning::Head image architecture '${arch}' has 0 CVE findings. Verify that OS/packages were recognized."
                 head_summary+=("  - ${arch}: ⚠️ WARNING (0 vulnerability findings detected)")
@@ -350,9 +386,40 @@ runs:
           err_log="cve-reports/target/cve-${arch}.err"
 
           echo "Scanning target SBOM for architecture: $arch"
+          scan_success=false
           if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+            scan_success=true
+          fi
+
+          vuln_cnt=0
+          if [ -s "$out_json" ]; then
+            cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
+            cnt=$(echo "$cnt" | tr -d '[:space:]')
+            [ -n "$cnt" ] && vuln_cnt="$cnt"
+          fi
+
+          # Fallback if in-build SBOM scan produced 0 CVEs (e.g. incompatible third-party format) or scan failed
+          if [ "$use_inbuild" = "true" ] && { [ "$scan_success" != "true" ] || [ "$vuln_cnt" -eq 0 ]; }; then
+            echo "::warning::In-build SBOM for target image (${arch}) yielded ${vuln_cnt} CVE findings. Falling back to direct Trivy image scan..."
+            t_plat="linux/${arch}"
+            [ "$arch" = "default" ] && t_plat=""
+            plat_arg=""
+            [ -n "$t_plat" ] && plat_arg="--platform $t_plat"
+            if trivy image --skip-version-check $plat_arg --format spdx-json --output "$f" "${{ inputs.target-image }}"; then
+              echo "Re-scanning target SBOM generated directly by Trivy..."
+              if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+                scan_success=true
+                if [ -s "$out_json" ]; then
+                  cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
+                  cnt=$(echo "$cnt" | tr -d '[:space:]')
+                  [ -n "$cnt" ] && vuln_cnt="$cnt"
+                fi
+              fi
+            fi
+          fi
+
+          if [ "$scan_success" = "true" ]; then
             if [ -s "$out_json" ]; then
-              vuln_cnt=$(grep -o '"VulnerabilityID"' "$out_json" 2>/dev/null | wc -l || echo 0)
               if [ "$vuln_cnt" -eq 0 ]; then
                 echo "::warning::Target baseline image architecture '${arch}' has 0 CVE findings. Verify that OS/packages were recognized."
                 target_summary+=("  - ${arch}: ⚠️ WARNING (0 vulnerability findings detected)")