Skip to content

fix: bump grype to 0.111.1 and fix checksum verification in container scan#183

Merged
coopernetes merged 5 commits into
mainfrom
fix/container-scan-grype-version
Apr 30, 2026
Merged

fix: bump grype to 0.111.1 and fix checksum verification in container scan#183
coopernetes merged 5 commits into
mainfrom
fix/container-scan-grype-version

Conversation

@coopernetes
Copy link
Copy Markdown
Member

@coopernetes coopernetes commented Apr 30, 2026

Summary

  • Bumps GRYPE_VERSION from 0.111.0 to 0.111.10.111.0 does not exist as a GitHub release, causing a 404 in the anchore/scan-action install step and the manual install in the container scan job
  • Fixes sha256sum verification in the container scan manual install: archive is now saved under its release filename so the checksum entry matches and sha256sum --check can verify it (old approach saved to /tmp/grype.tar.gz → "no file was verified", exit 1)
  • Drops the broken SARIF upload from the Gradle CVE job — grype SARIF output for sbom: inputs omits artifactLocation, causing GitHub code scanning to fail with locationFromSarifResult: expected artifact location
  • Adds human-readable table + JSON artifacts to both CVE jobs (grype-npm-scan, grype-gradle-scan) so findings are immediately accessible without downloading the raw SBOM. Uses scan-action's json output and locates the grype binary in the tool cache for the table report
  • Keeps SARIF upload on the npm job where path-based scans produce valid SARIF output

Test plan

  • CVE / npm: confirm grype-npm-scan artifact contains a non-empty table report and JSON on a failing run
  • CVE / Gradle: confirm grype-gradle-scan artifact contains a non-empty table report and JSON, and no SARIF upload error
  • Container Scan: trigger manually after merge and confirm Scan image and Install grype steps both pass and grype-container-scan artifact is populated

🤖 Generated with Claude Code

coopernetes and others added 5 commits April 29, 2026 12:21
… scan

grype 0.111.0 does not exist as a GitHub release, causing a 404 in the
install step. Also fix sha256sum verification: save the archive under
its release filename so the checksum entry matches and sha256sum --check
can verify the file.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…CVE jobs

grype SARIF output for sbom: inputs omits artifactLocation, causing GitHub
code scanning upload to fail with "expected artifact location". Replace the
broken upload-sarif step on the Gradle job with grype table+json artifacts
so findings are always accessible without downloading the SBOM.

Add the same artifact upload to the npm job as a fallback alongside the
existing SARIF upload (path-based scans produce valid SARIF).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
scan-action does not add grype to PATH for subsequent steps, so table
reports are generated by locating the binary in the tool cache. Each job
now uploads both a table report and the JSON from scan-action's output.

Drops the broken SARIF upload from the Gradle job (grype SARIF for sbom:
inputs omits artifactLocation, failing GitHub code scanning upload).
Keeps SARIF upload on the npm job where path-based scans produce valid output.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Resolves high severity CVEs:
- GHSA-v468-qcjx-r72w (httpclient5)
- GHSA-4wrg-8wpc-h923, GHSA-4vrc-j85c-598c (spring-security-config)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coopernetes coopernetes enabled auto-merge (squash) April 30, 2026 21:05
@coopernetes coopernetes disabled auto-merge April 30, 2026 21:05
@coopernetes coopernetes merged commit c0d3da7 into main Apr 30, 2026
12 checks passed
@coopernetes coopernetes deleted the fix/container-scan-grype-version branch April 30, 2026 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant