ci: run secscan on release for security scanning and SBOM generation (#196)

When the snap is released, use the sbomber tool to run the secscan tool
to do security scanning and SBOM generation as per the SSDLC.

Heavily based on the same workflow in Pebble.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tonyandrewmeyer

.github/.sbomber-manifest-snap.yaml

@@ -0,0 +1,15 @@
+clients:
+  sbom:
+    service_url: https://sbom-request.canonical.com
+    department: charm_engineering
+    email: tony.meyer@canonical.com
+    team: charm_tech
+  secscan: {}
+
+artifacts:
+  - name: concierge
+    type: snap
+    ssdlc_params:
+      name: concierge
+      version: ''  # auto-detect (snap store revision)
+      channel: stable

.github/workflows/release.yaml

@@ -161,3 +161,9 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_TOKEN }}
+
+  sbom-secscan:
+    name: SBOM and secscan
+    needs:
+      - release
+    uses: ./.github/workflows/sbom-secscan.yaml

.github/workflows/sbom-secscan.yaml

@@ -0,0 +1,30 @@
+name: SBOM and secscan
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: SBOM and secscan (snap)
+    # Self-hosted runner is required for access to the internal SBOM and
+    # secscan services.
+    runs-on: [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run sbomber
+        # main as of 2026-05-25 -- the sbomber-ref input below should match.
+        uses: canonical/sbomber/.github/actions/run@cf7a76e810497ec932e8285b2c9d6b373d225e79
+        with:
+          manifest: '${{ github.workspace }}/.github/.sbomber-manifest-snap.yaml'
+          artifact-name: secscan-report-upload-snap
+          sbomber-ref: cf7a76e810497ec932e8285b2c9d6b373d225e79

CONTRIBUTING.md

@@ -111,4 +111,4 @@ To release, simply create a new release in GitHub.
 4. Write release notes - start with the draft provided by GitHub, drop the `by @author` credit for anyone in the Charm Tech team (including Copilot and other AI users), and include a short summary of the new features and bug fixes at the top. Leave the link to the full list of commits and any acknowledgement of new contributors.
 5. Click "Publish release".
 6. Monitor the release [GitHub Action](https://github.com/canonical/concierge/actions) and check that the [snap](https://snapcraft.io/concierge) is uploaded correctly (it will have been published to all risks, including `stable`)
-7. Run the appropriate security scan and SBOM generation, as described in the Canonical library's SSDLC process. Upload artifacts to the [SSDLC Concierge folder in Drive](https://drive.google.com/drive/folders/1RtAn7x0EX97C6eV66xs74Pwth3KW7NHI). Open the artifact and verify that the security scan has not found any vulnerabilities.
+7. Find the security scan artifact on the corresponding [SBOM and secscan](https://github.com/canonical/concierge/actions/workflows/sbom-secscan.yaml) run, and upload it to the [SSDLC Concierge folder in Drive](https://drive.google.com/drive/folders/1RtAn7x0EX97C6eV66xs74Pwth3KW7NHI?usp=share_link). Open the artifact and verify that the security scan has not found any vulnerabilities.