Add entry in the FAQ about SCA tools support

Signed-off-by: tdruez <tdruez@nexb.com>

Author: tdruez

docs/faq.rst

@@ -363,3 +363,20 @@ The input to ScanCode is a local saved image: Docker or OCI.
 Docker in Docker support will demand to have access to the saved images
 (either extracted from the Docker images in Docker, or mounted in a volume or saved
 from the Docker in the Docker image). Once saved we can analyze these alright.
+
+Can I import SBOM from other SCA tools?
+---------------------------------------
+
+Yes! You can load SBOMs generated by other tools for further review and run
+pipelines to enrich or validate the data directly in ScanCode.io.
+
+While most valid SBOMs should work out of the box, SBOMs from the following tools
+are actively supported and tested::
+
+  - Anchore: https://anchore.com/sbom/
+  - CycloneDX cdxgen: https://cyclonedx.github.io/cdxgen/
+  - Trivy: https://trivy.dev/latest/
+
+.. note:: Imported SBOMs must follow the SPDX or CycloneDX standards, in JSON format.
+   You can use the ``load-sbom`` pipeline to process and enhance these SBOMs in your
+   ScanCode.io projects.

scanpipe/tests/test_sca_integrations.py

@@ -76,14 +76,9 @@ def test_scanpipe_scan_integrations_load_sbom_anchore(self):
 
     def test_scanpipe_scan_integrations_load_sbom_cdxgen(self):
         # Input file generated with:
-        # $ cdxgen alpine:3.17.0 \
-        #     --type docker \
-        #     --output cdxgen-alpine-3.17-sbom.json \
-        #     --spec-version 1.6 \
-        #     --json-pretty
-        input_location = (
-            self.data / "sca-integrations" / "cdxgen-alpine-3.17-sbom.json"
-        )
+        # $ cdxgen alpine:3.17.0 --type docker --spec-version 1.6 --json-pretty \
+        #     --output cdxgen-alpine-3.17-sbom.json
+        input_location = self.data / "sca-integrations" / "cdxgen-alpine-3.17-sbom.json"
 
         pipeline_name = "load_sbom"
         project1 = make_project()