Compare vulnerabilities between (Base) develop and (Base) TASK-7908 by @juanfeSanahuja #14

	name: Compare vulnerabilities (Syft SBOM -> Grype) between two branches (robust)
	run-name: 'Compare vulnerabilities between (Base) ${{ inputs.branch_a }} and (Base) ${{ inputs.branch_b }} by @${{ github.actor }}'
	on:
	workflow_dispatch:
	inputs:
	branch_a:
	description: 'Base branch (e.g. develop)'
	required: true
	default: 'develop'
	branch_b:
	description: 'Head branch (e.g. TASK-1234)'
	required: true

	jobs:
	compare-sbom-grype:
	runs-on: ${{ vars.UBUNTU_VERSION }}

	steps:
	# 1) Checkout head branch only
	- name: Checkout head branch
	uses: actions/checkout@v4
	with:
	ref: ${{ github.event.inputs.branch_b }}
	fetch-depth: 0
	fetch-tags: true

	# 2) Ensure base branch exists locally (fetch)
	- name: Fetch base branch
	run: \|
	git fetch origin ${{ github.event.inputs.branch_a }}:refs/remotes/origin/${{ github.event.inputs.branch_a }}

	# 3) Run the action
	- name: Vulnerability Diff (Syft+Grype)
	uses: sec-open/vuln-diff-action@v1
	with:
	base_ref: ${{ github.event.inputs.branch_a }} # pass 'develop'
	head_ref: ${{ github.event.inputs.branch_b }} # pass 'TASK-7908'
	build_command: ""
	write_summary: "true"
	upload_artifact: "true"
	report_pdf: "true"
	min_severity: "LOW"

Navigation Menu