chore: migrate from Trivy to Grype for vulnerability scanning#1772
chore: migrate from Trivy to Grype for vulnerability scanning#1772
Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the reusable GitHub Actions “Security Checks” workflow from Trivy to Anchore Grype (via anchore/scan-action) to perform repository vulnerability scanning in CI.
Changes:
- Replaced
aquasecurity/trivy-actionwithanchore/scan-action(Grype) pinned to v7.3.2. - Updated scan configuration to filesystem scanning at
path: ".", failing the build on findings above the cutoff and considering only fixed vulnerabilities.
| - name: Scan repo | ||
| uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0 | ||
| id: grype-scan | ||
| uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2 | ||
| with: | ||
| scan-type: 'fs' | ||
| scan-ref: '.' | ||
| scanners: 'vuln,secret,config' | ||
| exit-code: '1' | ||
| ignore-unfixed: 'true' | ||
| severity: 'MEDIUM,HIGH,CRITICAL' | ||
| path: "." | ||
| fail-build: true | ||
| only-fixed: true | ||
| severity-cutoff: "medium" |
There was a problem hiding this comment.
This migration drops the previous secret and config scanning that was done by Trivy (scanners: vuln,secret,config), so the workflow now only performs vulnerability scanning. If that broader coverage was intentional, consider adding equivalent secret/config scanning as separate jobs/steps (or configuring anchore tooling to cover those areas) so we don't regress CI security checks.
|
|
||
| - name: Scan repo | ||
| uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0 | ||
| id: grype-scan |
There was a problem hiding this comment.
The step id: grype-scan doesn't appear to be referenced by any later steps/outputs in this workflow. Consider removing the unused step id to reduce noise, or add a follow-up step that consumes its outputs (e.g., to upload a report) if that was the intent.
| id: grype-scan |
|
@JAORMX a rebase is needed |
Replace aquasecurity/trivy-action with anchore/scan-action (Grype) v7.3.2 for vulnerability scanning. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
peppescg
force-pushed
the
chore/migrate-trivy-to-grype
branch
from
d2dfe7e to
9873ccc
Compare
Summary
aquasecurity/trivy-actionwithanchore/scan-action(Grype) v7.3.2 for vulnerability scanningTest plan
🤖 Generated with Claude Code