Move anchore scan

Author: rubenhensen

.github/workflows/delivery.yml

@@ -67,22 +67,6 @@ jobs:
           cache-from: type=gha,scope=build-amd64
           cache-to: type=gha,mode=max,scope=build-amd64
 
-      - name: Scan image
-        uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
-        id: scan
-        with:
-          image: ghcr.io/${{ github.repository }}:build-${{ github.run_id }}-amd64
-          only-fixed: true
-          fail-build: true
-          severity-cutoff: critical
-          output-format: sarif
-
-      - name: Upload Anchore scan SARIF report
-        uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4
-        if: ${{ !cancelled() }}
-        with:
-          sarif_file: ${{ steps.scan.outputs.sarif }}
-
   build-arm64:
     runs-on: ubuntu-24.04-arm
     needs: [config]
@@ -150,3 +134,19 @@ jobs:
             $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             "ghcr.io/${{ github.repository }}@${{ needs.build-amd64.outputs.digest }}" \
             "ghcr.io/${{ github.repository }}@${{ needs.build-arm64.outputs.digest }}"
+
+      - name: Scan image
+        uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
+        id: scan
+        with:
+          image: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
+          only-fixed: true
+          fail-build: true
+          severity-cutoff: critical
+          output-format: sarif
+
+      - name: Upload Anchore scan SARIF report
+        uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4
+        if: ${{ !cancelled() }}
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}