Skip to content

CHEF-31147: Added config for grype hab pkg scan #59

CHEF-31147: Added config for grype hab pkg scan

CHEF-31147: Added config for grype hab pkg scan #59

Triggered via pull request April 14, 2026 10:16
Status Failure
Total duration 2m 45s
Artifacts 8
Detect custom properties
2s
Detect custom properties
Echo stub version
2s
Echo stub version
call-ci-main-pr-check-pipeline  /  Checkout repository
4s
call-ci-main-pr-check-pipeline / Checkout repository
call-ci-main-pr-check-pipeline  /  Pre-compilation checks
2s
call-ci-main-pr-check-pipeline / Pre-compilation checks
call-ci-main-pr-check-pipeline  /  Build/compilation and unit tests (CI)
54s
call-ci-main-pr-check-pipeline / Build/compilation and unit tests (CI)
call-ci-main-pr-check-pipeline  /  ...  /  Export SBOM from GitHub Dependency Graph API
7s
call-ci-main-pr-check-pipeline / Generating SBOM / Export SBOM from GitHub Dependency Graph API
call-ci-main-pr-check-pipeline  /  ...  /  Blackduck SCA Scan (PURPLE)
call-ci-main-pr-check-pipeline / Generating SBOM / Blackduck SCA Scan (PURPLE)
call-ci-main-pr-check-pipeline  /  ...  /  Generate MSFT SBOM
call-ci-main-pr-check-pipeline / Generating SBOM / Generate MSFT SBOM
call-ci-main-pr-check-pipeline  /  ...  /  license_scout
call-ci-main-pr-check-pipeline / Generating SBOM / license_scout
call-ci-main-pr-check-pipeline  /  ...  /  Complexity and SLOC generation
23s
call-ci-main-pr-check-pipeline / Source code complexity checks / Complexity and SLOC generation
call-ci-main-pr-check-pipeline  /  Language-specific pre-compilation steps and linting
call-ci-main-pr-check-pipeline / Language-specific pre-compilation steps and linting
call-ci-main-pr-check-pipeline  /  Language-agnostic pre-compilation steps
call-ci-main-pr-check-pipeline / Language-agnostic pre-compilation steps
call-ci-main-pr-check-pipeline  /  ...  /  Trufflehog
14s
call-ci-main-pr-check-pipeline / Trufflehog scan / Trufflehog
call-ci-main-pr-check-pipeline  /  Grype scan
1m 19s
call-ci-main-pr-check-pipeline / Grype scan
call-ci-main-pr-check-pipeline  /  ...  /  Grype scan (Linux)
1m 11s
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Linux)
call-ci-main-pr-check-pipeline  /  ...  /  Grype scan (Windows)
2m 26s
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Windows)
call-ci-main-pr-check-pipeline  /  ...  /  Grype scan (MacOS)
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (MacOS)
call-ci-main-pr-check-pipeline  /  ...  /  BlackDuck Polaris SAST scan
call-ci-main-pr-check-pipeline / BlackDuck Polaris SAST scan / BlackDuck Polaris SAST scan
call-ci-main-pr-check-pipeline  /  ...  /  Grype vulnerability scan
call-ci-main-pr-check-pipeline / Grype Docker image scan / Grype vulnerability scan
call-ci-main-pr-check-pipeline  /  Creating packaged binaries
0s
call-ci-main-pr-check-pipeline / Creating packaged binaries
call-ci-main-pr-check-pipeline  /  Detect SBOM version for application
0s
call-ci-main-pr-check-pipeline / Detect SBOM version for application
Matrix: call-ci-main-pr-check-pipeline / Unit tests
call-ci-main-pr-check-pipeline  /  ...  /  irfan
call-ci-main-pr-check-pipeline / Reporting to quality dashboard / irfan
call-ci-main-pr-check-pipeline  /  Creating Habitat packages
0s
call-ci-main-pr-check-pipeline / Creating Habitat packages
call-ci-main-pr-check-pipeline  /  Publishing Habitat packages to Builder
0s
call-ci-main-pr-check-pipeline / Publishing Habitat packages to Builder
call-ci-main-pr-check-pipeline  /  Publishing packages
0s
call-ci-main-pr-check-pipeline / Publishing packages
call-ci-main-pr-check-pipeline  /  Grype scan of Habitat packages
0s
call-ci-main-pr-check-pipeline / Grype scan of Habitat packages
call-ci-main-pr-check-pipeline  /  Grype scan of Habitat packages (Windows)
0s
call-ci-main-pr-check-pipeline / Grype scan of Habitat packages (Windows)
Fit to window
Zoom out
Zoom in

Annotations

3 errors and 8 warnings
call-ci-main-pr-check-pipeline / Grype scan
Process completed with exit code 1.
Detect custom properties
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Detect custom properties
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Detect custom properties
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
call-ci-main-pr-check-pipeline / Generating SBOM / Export SBOM from GitHub Dependency Graph API
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Source code complexity checks / Complexity and SLOC generation
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Linux)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Grype scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Windows)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
chef-chef-cli-20260414101630-GitHub-sbom.json
2.12 KB
sha256:329e7ca5f0498d6836d6f955516c1d838da061c941680da5aa5440c9a93c2088
chef-chef-cli-334-merge-20260414101645-scc-complexity.html Expired
8.55 KB
sha256:76ca870882068838d6b26ebd65b685c59399e76fb01e0ffcc4f9e8beafb5b49d
chef-chef-cli-334-merge-20260414101645-scc-complexity.json Expired
10.9 KB
sha256:df8ab59e7890a102dbf1b73b07fd938fc1f343e14e06ffd045f357f02b386ad2
chef-chef-cli-334-merge-20260414101645-scc-complexity.txt Expired
766 Bytes
sha256:42d60ae41bc11618ac6699d48081826876049f029b198a4253b54f6d8dd2a674
chef-chef-cli-334-merge-6.1.29-20260414101630-GitHub-sbom.csv
1.22 KB
sha256:d3311c891750ddadf179faf9b33dd9a13cff5a892fd1ddf18547e8fb889eb64f
grype-scan-chef-cli-20260414-101742
5.8 KB
sha256:980ff3dc7ce20f41e2aa7ece2a0dc05d444b162d043cbb24dd927df9082d3ff1
grype-scan-linux-chef-cli-20260414-101635
16.1 KB
sha256:d005cc4257c742847c66de29ec7f279f932436f504e34bf7695f7e442458391b
grype-scan-windows-chef-cli-20260414-101642
12 KB
sha256:8ce4e7a0da8d153bcc9068dd28654fbda0044c6fd39a9e90826e5119737e35f1