From e87136b58c63ac99cb5838cc05f8aa7e6d0b3f09 Mon Sep 17 00:00:00 2001
From: Anika Weinmann <37300249+anikaweinmann@users.noreply.github.com>
Date: Fri, 11 Sep 2026 15:30:23 +0200
Subject: [PATCH] Update Anchore actions to specific commit versions

---
 .github/workflows/sbom-vulnerability-scan.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sbom-vulnerability-scan.yml b/.github/workflows/sbom-vulnerability-scan.yml
index a744f06..44fcec8 100644
--- a/.github/workflows/sbom-vulnerability-scan.yml
+++ b/.github/workflows/sbom-vulnerability-scan.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Generate SBOM from Docker image
         if: inputs.dockerfile != ''
-        uses: anchore/sbom-action@v0.24.2
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
           image: localbuild/testimage:latest
           artifact-name: docker.cyclonedx.json
@@ -76,8 +76,9 @@ jobs:
       - name: Scan Docker SBOM for vulnerabilities
         if: inputs.dockerfile != ''
         id: docker-vulnerability-scan
-        uses: anchore/scan-action@v7
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2
         with:
+          image: 
           sbom: docker.cyclonedx.json
           fail-build: ${{ inputs.fail-build }}
           output-format: sarif