fix order

Author: gildesmarais

.github/workflows/test_build_push.yml

@@ -86,28 +86,6 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-buildx-
 
-      - name: Generate SBOM
-        uses: anchore/sbom-action@v0.15.3
-        with:
-          image: gilcreator/html2rss-web:latest
-          output-file: sbom.spdx.json
-
-      - name: Upload SBOM Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: sbom
-          path: sbom.spdx.json
-
-      # - name: Publish SBOM to Docker Hub Description
-      #   env:
-      #     DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      #     DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-      #   run: |
-      #     curl -s -X PATCH "https://hub.docker.com/v2/repositories/${IMAGE_NAME}/" \
-      #       -H "Content-Type: application/json" \
-      #       -u "$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN" \
-      #       -d '{"full_description": "Auto-generated SBOM: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts"}'
-
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
@@ -128,15 +106,17 @@ jobs:
             org.opencontainers.image.description=Generates RSS feeds of any website & serves to the web!
             org.opencontainers.image.sbom=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts
 
-      - name: Scan Docker image for vulnerabilities (Trivy)
-        uses: aquasecurity/trivy-action@0.31.0
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0.20.1
+        with:
+          image: gilcreator/html2rss-web:latest
+          output-file: sbom.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v4
         with:
-          image-ref: gilcreator/html2rss-web:latest
-          format: table
-          exit-code: 1
-          ignore-unfixed: true
-          vuln-type: os,library
-          severity: CRITICAL,HIGH
+          name: sbom
+          path: sbom.spdx.json
 
       - name: Move updated cache into place
         run: |