FEATURE : Define manifest when sending SBOM to Github Dependency

[Maxim-Durand]

Feature request

Using the feature of SBOM generation and sending it to Github works very well except it doesn't send the manifest details.

Meaning if you scan an image like so:

- name: Run Trivy vulnerability scanner in fs mode
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: "fake_private_image:latest"
    scan-type: image
    format: 'github'
    output: 'dependency-results.sbom.json'
    github-pat: ${{ secrets.GITHUB_TOKEN }}
    severity: "MEDIUM,HIGH,CRITICAL"
    scanners: "vuln"
  env:
    TRIVY_USERNAME: "REDACTED"
    TRIVY_PASSWORD: "REDACTED"

If you look in github security alerts tab, you can see the following:

It shows the vulnerabilities but without any specific manifest.
Using the example above it could specify the docker image scanned (i.e fake_private_image:latest in this example).

---

Proposed solution

When the user specifies format: github and scan-type: image, trivy-action could replace the manifest definition in the SBOM files by the docker image value instead ?