chore: replace Syft with Trivy for SBOM generation in build and release workflows

.gitea/workflows/kiwi-build.yaml

@@ -34,7 +34,11 @@ jobs:
           zypper if python3-kiwi
           echo "========================"
 
-          zypper --non-interactive in nodejs libxml2-tools git
+          zypper --non-interactive in nodejs libxml2-tools git curl
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
       - name: Checkout Repository
         uses: actions/checkout@v7
@@ -62,6 +66,11 @@ jobs:
             --bundle-dir ./dist \
             --id gitea-build-${{ steps.vars.outputs.sha_short }}
 
+      - name: Generate SBOM
+        run: |
+          trivy fs --format spdx-json --output ./dist/openSUSE-Leap-16.0-Minimal-gitea-build-${{ steps.vars.outputs.sha_short }}.spdx.json /tmp/build/build/image-root
+          trivy fs --format cyclonedx --output ./dist/openSUSE-Leap-16.0-Minimal-gitea-build-${{ steps.vars.outputs.sha_short }}.cdx.json /tmp/build/build/image-root
+
       - name: Upload Disk Image
         uses: actions/upload-artifact@v7
         with:
@@ -77,4 +86,6 @@ jobs:
             ./dist/*.packages
             ./dist/*.changes
             ./dist/*.verified
+            ./dist/*.spdx.json
+            ./dist/*.cdx.json
           retention-days: 7

.gitea/workflows/kiwi-release.yaml

@@ -17,6 +17,10 @@ jobs:
         run: |
           zypper --non-interactive in nodejs libxml2-tools git curl jq
 
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
       - name: Checkout Repository
         uses: actions/checkout@v7
 
@@ -29,6 +33,11 @@ jobs:
           kiwi-ng --profile Cloud system build --description ./opensuse-leap-16-minimal --target-dir /tmp/build
           kiwi-ng result bundle --target-dir /tmp/build --bundle-dir ./dist --id ${{ github.ref_name }}
 
+      - name: Generate SBOM
+        run: |
+          trivy fs --format spdx-json --output ./dist/openSUSE-Leap-16.0-Minimal-${{ github.ref_name }}.spdx.json /tmp/build/build/image-root
+          trivy fs --format cyclonedx --output ./dist/openSUSE-Leap-16.0-Minimal-${{ github.ref_name }}.cdx.json /tmp/build/build/image-root
+
       # 1. Gitea Release erstellen und Image-Datei als Asset anhängen
       - name: Create Gitea Release
         uses: akkuman/gitea-release-action@v1
@@ -41,11 +50,13 @@ jobs:
           files: |-
             ./dist/*.qcow2
             ./dist/*.raw.xz
+            ./dist/*.spdx.json
+            ./dist/*.cdx.json
 
       # 2. Harvester triggern (zieht sich die Datei aus dem Release)
       - name: Trigger Harvester Download
         env:
-          HARVESTER_URL: "https://harvester.ui"
+          HARVESTER_URL: ${{ secrets.HARVESTER_URL }}
           HARVESTER_TOKEN: ${{ secrets.HARVESTER_TOKEN }}
           NAMESPACE: "default"
         run: |
@@ -66,7 +77,7 @@ jobs:
                 "namespace": "'"${NAMESPACE}"'"
               },
               "spec": {
-                "displayName": "openSUSE Leap 16.0 Minimal (${{ github.ref_name }})",
+                "displayName": "openSUSE-Leap-16.0-Minimal-${{ github.ref_name }}",
                 "description": "Gebaute KIWI-NG Vorlage aus Tag ${{ github.ref_name }}",
                 "sourceType": "download",
                 "url": "'"${DOWNLOAD_URL}"'"