ci: cache Grype vulnerability DB across image scans#6543
Conversation
The supply-chain scan ran 'docker run --rm anchore/grype' once per image with no shared cache, so every image re-downloaded the full ~200MB+ vulnerability DB (~1 min each). With ~10 images this dominated the job at ~9 minutes. Share a single DB across all scans: warm it once with 'grype db update' into a mounted cache dir, disable per-image auto-update, and persist the dir across runs via actions/cache. Cuts the Grype step from ~9 min to roughly the DB warm-up plus fast per-image scans (and near-zero warm-up on a cache hit). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fc43a66c-c49d-46ef-b9f0-02527a9102fb
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
Caches and reuses Grype’s vulnerability database to reduce repeated image-scan downloads.
Changes:
- Adds Grype DB caching across workflow runs.
- Warms the shared DB once.
- Reuses the DB for each image scan.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/supply-chain-scan.yml |
Adds Grype DB caching, warm-up, and reuse. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Medium
| - name: Cache Grype vulnerability DB | ||
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 |
| key: grype-db-v6-${{ github.run_id }} | ||
| restore-keys: | | ||
| grype-db-v6- |
|
@copilot merge main |
# Conflicts: # .github/workflows/supply-chain-scan.yml
Done — merged The conflict in
|
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
@copilot address review feedback |
Both reviewer concerns were already addressed in merge commit
|
|
🔑 Smoke Copilot PAT reports failed. PAT auth path may have issues... |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ |
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤 |
|
🔌 Smoke Services — All services reachable! ✅ |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed... |
|
✅ Smoke Gemini completed. All facets verified. 💎 |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
🚀 Security Guard has started processing this pull request |
|
✅ Smoke Claude passed |
|
✅ Contribution Check completed successfully! PR #6543 review complete: no contribution-guideline issues found in the provided context, so no PR comment was needed. |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ Build Test Suite completed successfully! |
Smoke Test: Claude Engine Validation
Overall result: PASS ✅
|
|
@lpcox — Smoke test: Copilot Network Isolation Egress Enforcement EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain ( Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
Smoke Test: Services Connectivity
Overall: FAIL —
|
Smoke Test: Copilot BYOK (Direct) Mode✅ All tests passed
Status: PASS | Running in direct BYOK mode
|
Gemini Smoke Test Results
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
🔬 Smoke Test Results
Overall: PASS cc @lpcox
|
Smoke Test: API Proxy OTEL Tracing — Results
All 5 scenarios pass. OTEL tracing integration is functional.
|
Chroot Version Comparison Results
Overall: ❌ FAILED — Node.js version mismatch between host (
|
|
Smoke test results:
|
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall status: PASS
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
🔬 Smoke Test Results — Docker Sbx
Overall: PARTIAL — workflow template variables (
|
Problem
The Supply Chain Scan check takes ~10 minutes, almost entirely in one step: "Scan images for CVEs (Grype)" ≈ 542s (~9 min). Everything else (checkout, gh-aw install, Syft compile) totals under 90s.
Root cause: the scan loops over ~10 container images, running
docker run --rm anchore/grype registry:<image>for each one. Because each invocation is ephemeral with no shared cache, Grype re-downloads and imports its full vulnerability DB from scratch for every image. Every image took a near-identical ~60s — the tell that the per-image cost is DB hydration, not CVE matching:10 images × ~60s of redundant DB download ≈ 9 min.
Fix
Share a single vulnerability DB across all scans:
grype db updateinto a mounted cache dir before the loop.docker runand setGRYPE_DB_AUTO_UPDATE=false/GRYPE_CHECK_FOR_APP_UPDATE=falseso no image re-downloads or re-checks.actions/cache, so most runs skip the download entirely.Expected: the Grype step drops from ~9 min to roughly one DB warm-up + fast per-image scans (near-zero warm-up on a cache hit).
Do Syft and Grant need the same treatment?
gh aw compile --syftinvocation (~87s total) and has no vulnerability DB, so there's nothing re-downloaded per image.Notes
--fail-on highgate firing on a high/critical CVE in one image — a separate correctness signal, not addressed by this performance change.actions/cachepinned to the same SHA (v6.1.0) already used elsewhere in the repo.