Repository navigation
Replace Docker Scout image scan with Grype - #446
Merged
Merged
Conversation
Docker Scout frequently failed without explanation after "storing image for indexing". Scan the image with Grype instead, installed from a pinned release tarball verified against a hardcoded SHA256 rather than through a third-party action. - Export the build to a tarball instead of loading into the daemon - Free runner disk space before building - Drop the Docker Hub login (no secrets needed), so fork PRs get scanned - Keep PR comment and SARIF upload for same-repo PRs, master and schedule - Skip SARIF upload for ephemeral merge queue refs - Align upload-sarif pin with the codeql-action SHA used in codeql.yml Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Grype vulnerability scan (fixable only)
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Docker Scout step frequently failed with no explanation after printing "storing image for indexing". The logs from past failures have expired (HTTP 410), so the exact cause is unknown. The pattern suggests Scout ran out of memory or disk while indexing our large local image. This PR replaces Scout with Grype.
Security
grype_0.120.1_checksums.txt(signer:anchore/grype/.github/workflows/release.yaml@refs/heads/main). A hijacked tag or swapped release asset can't change what runs, which is the gap the recent Trivy compromise exploited.upload-sarifwas pinned far behind the codeql-action SHA incodeql.yml, so it now uses that SHA.Other changes
ghCLI and updated on later pushes.doc/ci.rstis updated.After merging
Old Docker Scout alerts in Code scanning won't close automatically, so they need to be dismissed by hand.
🤖 Generated with Claude Code