Fix(ci): Surface Grype findings on audit failure

[ModeSevenIndustrialSolutions]

Summary

Improves the SBOM/Grype audit workflow so that, when a vulnerability
scan fails, the failing check surfaces the actual CVE/package
information directly in its log, and the job step summary presents the
findings as a proper Markdown table.

Applies to both build-test.yaml (PR CI) and
build-test-release.yaml (tag-push release CI).

Problem

When the Grype audit of the SBOM failed on a PR, the job that produced
useful console output (Security scan with Grype (Text/Table)) was
marked as successful, while the other (Security scan with Grype (SARIF))
owned the failure but its log only contained the terse
Failed minimum severity level message with no CVE context.

Additionally:

• The job was named Generate SBOM, so failures looked like the SBOM
  could not be generated, when in reality the generation succeeded and
  it was the audit of the SBOM that failed.
• The step summary dumped raw Grype table text (with whitespace-only
  column alignment) into $GITHUB_STEP_SUMMARY, producing a
  hard-to-read wall of text.
• Running three separate anchore/scan-action invocations (SARIF,
  JSON, Text/Table) produced three duplicate
  Failed minimum severity level… job annotations, one per
  invocation, with none of them carrying the CVE context.

Changes

Split sbom into sbom + grype jobs

• The workflow now has separate Generate SBOM and Grype Audit SBOM
  jobs, with the grype job depending on sbom and consuming the
  uploaded sbom-files artefact. Failures are now clearly attributed
  to whichever job actually failed.
• grype is added to the test-pypi job's needs list so
  vulnerability findings gate publishing (and transitively, the
  production pypi publish). The existing NO_BLOCK_AUDIT_FAIL
  repository-variable override still allows releases to proceed when
  blocked by newly discovered CVEs in transitive dependencies.

Single-step Grype invocation

• Replaced the three anchore/scan-action invocations with a single
  Grype run driven by anchore/scan-action/download-grype plus a
  shell step we fully control. Grype is executed once with
  -o sarif=… -o json=… -o table=…, producing all three output
  formats at once.
• The step prints the human-readable table into its own log, so
  clicking through to a failing check in the Actions UI immediately
  shows the offending packages and CVEs.
• The step then evaluates Grype's exit code and emits exactly one
  ::error:: (or ::warning:: when NO_BLOCK_AUDIT_FAIL='true')
  with the reason for the failure. No duplicate annotations.

Markdown-table job step summary

• The step summary renders a proper Markdown table sourced from
  grype-results.json and processed with jq. Parsing structured
  JSON avoids the alignment/cell-delimiter hazards that a naive split
  of the pre-formatted Grype text would introduce; any literal pipe
  characters in cell content are escaped as \|.
• EPSS probabilities are formatted as percentages to two decimal
  places (with a <0.01% threshold for very small non-zero values),
  and risk scores are rounded to two decimals to avoid IEEE-754 float
  representation artefacts.

Other workflow-quality fixes

• Reworded the SARIF-output comment to drop the misleading
  "code scanning ingestion" phrasing, since this workflow doesn't
  invoke github/codeql-action/upload-sarif.
• if-no-files-found on the Grype artefact upload changed from
  ignore to warn so missing expected outputs surface in logs
  instead of being silently tolerated.

Verification

The new behaviour was verified end to end on the fork PR
(modeseven-lfit/dependamerge#1) by temporarily forcing the
transitive h11 dependency to 0.12.0 via a [tool.uv]
override-dependencies pin, which triggered
GHSA-vqfr-h8mv-ghfj
(Critical) in the Grype audit. The verification commits (the h11
pin and a temporary pull_request trigger relaxation) have been
removed; this branch contains only the actual fix commits, rebased
onto upstream/main.

During verification:

• The Generate SBOM job succeeded.
• The Grype Audit SBOM job failed with one informative failure
  annotation naming the CVE, plus the runner's generic
  Process completed with exit code 1 status annotation (which is
  always emitted for a failing step and cannot be suppressed without
  also suppressing job failure).
• The job step summary rendered the CVE as a Markdown table.
• The grype-scan-results artefact contained SARIF, JSON, and
  table-text files.

The jq pipeline was also verified locally against a Grype JSON scan
of an intentionally vulnerable environment (cryptography==41.0.0 +
pytest==7.0.0, 11 matches); sample output:

Package	Installed	Fixed In	Type	Vulnerability	Severity	EPSS	Risk
cryptography	41.0.0	41.0.2	python	GHSA-cf7p-gm2m-833m	High	1.09%	0.85
cryptography	41.0.0	42.0.4	python	GHSA-6vqw-3v5j-54x4	High	0.42%	0.31
cryptography	41.0.0	46.0.5	python	GHSA-r6ph-v2qm-q3c2	High	<0.01%	0
pytest	7.0.0	9.0.3	python	GHSA-6w46-j5rx-g56g	Medium	<0.01%	0

The pipe-escape path also produces the Markdown-correct
single-backslash escape (e.g. a hypothetical package name
pytest|weird renders as pytest\|weird).

[Copilot]

Pull request overview

Updates the CI SBOM vulnerability auditing so Grype failures surface actionable CVE/package details directly in failing logs and in the job step summary, improving debuggability for both PR CI and release CI workflows.

Changes:

• Split SBOM generation from Grype auditing into separate sbom and grype jobs, with artifact handoff between them.
• Replace multiple anchore/scan-action runs with a single Grype invocation that emits SARIF/JSON/table outputs at once and produces a single annotation.
• Render Grype findings in $GITHUB_STEP_SUMMARY as a Markdown table derived from grype-results.json via jq.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/build-test.yaml	Splits SBOM vs Grype into separate jobs and adds JSON-driven Markdown summary + consolidated Grype run.
.github/workflows/build-test-release.yaml	Mirrors the PR workflow improvements for releases and adds grype as a publishing gate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

This PR improves CI ergonomics for SBOM vulnerability auditing by making Grype failures actionable (CVE/package details visible in the failing step log) and by rendering Grype findings as a readable Markdown table in the job step summary. It also clarifies responsibility for failures by separating SBOM generation from the Grype audit into distinct jobs.

Changes:

• Split SBOM generation and Grype auditing into separate sbom and grype jobs so failures are attributed correctly.
• Replace multiple anchore/scan-action invocations with a single Grype run emitting SARIF/JSON/table outputs, with one authoritative annotation.
• Render Grype findings into $GITHUB_STEP_SUMMARY as a Markdown table derived from JSON via jq (with pipe escaping and numeric formatting), and warn on missing expected artifacts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/build-test.yaml	Separates SBOM + Grype into dedicated jobs; runs Grype once and surfaces findings in logs + Markdown step summary; uploads Grype outputs (SARIF/JSON/table).
.github/workflows/build-test-release.yaml	Mirrors the PR-CI workflow improvements for release CI; ensures publishing is gated on the Grype audit job and outputs are surfaced consistently.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

This PR improves how Grype SBOM audit failures are surfaced in GitHub Actions by ensuring the failing check logs and step summaries include actionable CVE/package details, and by making failure attribution clearer in both PR CI and release CI workflows.

Changes:

• Split SBOM generation and Grype auditing into separate jobs so failures are attributed to the correct job.
• Run Grype once to emit SARIF/JSON/table outputs, printing the table directly into the failing step’s log and emitting a single annotation.
• Render Grype findings into a Markdown table in the job step summary using structured JSON + jq, and warn (not ignore) when expected artifacts are missing.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/build-test.yaml	Separates SBOM generation from Grype audit and improves audit logging + Markdown summary output for PR CI.
.github/workflows/build-test-release.yaml	Mirrors the CI improvements for release CI and gates publishing on the Grype audit job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.