Skip to content

CHEF-31147: Added config for grype hab pkg scan #1

CHEF-31147: Added config for grype hab pkg scan

CHEF-31147: Added config for grype hab pkg scan #1

Triggered via pull request April 14, 2026 19:54
Status Failure
Total duration 2m 57s
Artifacts 8
Detect custom properties
5s
Detect custom properties
Echo stub version
2s
Echo stub version
call-ci-main-pr-check-pipeline  /  Checkout repository
5s
call-ci-main-pr-check-pipeline / Checkout repository
call-ci-main-pr-check-pipeline  /  Pre-compilation checks
4s
call-ci-main-pr-check-pipeline / Pre-compilation checks
call-ci-main-pr-check-pipeline  /  Build/compilation and unit tests (CI)
49s
call-ci-main-pr-check-pipeline / Build/compilation and unit tests (CI)
call-ci-main-pr-check-pipeline  /  ...  /  Export SBOM from GitHub Dependency Graph API
5s
call-ci-main-pr-check-pipeline / Generating SBOM / Export SBOM from GitHub Dependency Graph API
call-ci-main-pr-check-pipeline  /  ...  /  Blackduck SCA Scan (PURPLE)
0s
call-ci-main-pr-check-pipeline / Generating SBOM / Blackduck SCA Scan (PURPLE)
call-ci-main-pr-check-pipeline  /  ...  /  Generate MSFT SBOM
0s
call-ci-main-pr-check-pipeline / Generating SBOM / Generate MSFT SBOM
call-ci-main-pr-check-pipeline  /  ...  /  license_scout
0s
call-ci-main-pr-check-pipeline / Generating SBOM / license_scout
call-ci-main-pr-check-pipeline  /  ...  /  Complexity and SLOC generation
22s
call-ci-main-pr-check-pipeline / Source code complexity checks / Complexity and SLOC generation
call-ci-main-pr-check-pipeline  /  Language-specific pre-compilation steps and linting
0s
call-ci-main-pr-check-pipeline / Language-specific pre-compilation steps and linting
call-ci-main-pr-check-pipeline  /  Language-agnostic pre-compilation steps
0s
call-ci-main-pr-check-pipeline / Language-agnostic pre-compilation steps
call-ci-main-pr-check-pipeline  /  ...  /  Trufflehog
14s
call-ci-main-pr-check-pipeline / Trufflehog scan / Trufflehog
call-ci-main-pr-check-pipeline  /  Grype scan
40s
call-ci-main-pr-check-pipeline / Grype scan
call-ci-main-pr-check-pipeline  /  ...  /  Grype scan (Linux)
1m 12s
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Linux)
call-ci-main-pr-check-pipeline  /  ...  /  Grype scan (Windows)
2m 24s
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Windows)
call-ci-main-pr-check-pipeline  /  ...  /  Grype scan (MacOS)
0s
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (MacOS)
call-ci-main-pr-check-pipeline  /  ...  /  BlackDuck Polaris SAST scan
call-ci-main-pr-check-pipeline / BlackDuck Polaris SAST scan / BlackDuck Polaris SAST scan
call-ci-main-pr-check-pipeline  /  ...  /  Grype vulnerability scan
call-ci-main-pr-check-pipeline / Grype Docker image scan / Grype vulnerability scan
call-ci-main-pr-check-pipeline  /  Creating packaged binaries
4s
call-ci-main-pr-check-pipeline / Creating packaged binaries
call-ci-main-pr-check-pipeline  /  Detect SBOM version for application
call-ci-main-pr-check-pipeline / Detect SBOM version for application
Matrix: call-ci-main-pr-check-pipeline / Unit tests
call-ci-main-pr-check-pipeline  /  ...  /  irfan
call-ci-main-pr-check-pipeline / Reporting to quality dashboard / irfan
call-ci-main-pr-check-pipeline  /  Creating Habitat packages
3s
call-ci-main-pr-check-pipeline / Creating Habitat packages
call-ci-main-pr-check-pipeline  /  Publishing Habitat packages to Builder
call-ci-main-pr-check-pipeline / Publishing Habitat packages to Builder
call-ci-main-pr-check-pipeline  /  Publishing packages
call-ci-main-pr-check-pipeline / Publishing packages
call-ci-main-pr-check-pipeline  /  Grype scan of Habitat packages
call-ci-main-pr-check-pipeline / Grype scan of Habitat packages
call-ci-main-pr-check-pipeline  /  Grype scan of Habitat packages (Windows)
call-ci-main-pr-check-pipeline / Grype scan of Habitat packages (Windows)
Fit to window
Zoom out
Zoom in

Annotations

2 errors and 6 warnings
Detect custom properties
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Generating SBOM / Export SBOM from GitHub Dependency Graph API
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Source code complexity checks / Complexity and SLOC generation
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Grype scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Linux)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
call-ci-main-pr-check-pipeline / Grype scan Habitat packages from bldr.habitat.sh / Grype scan (Windows)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
chef-chef-cli-20260414195434-GitHub-sbom.json
2.12 KB
sha256:3474aea1192c66642868e2a925e344e3f76f114efbb6858c56596f95d37a701a
chef-chef-cli-334-merge-20260414195450-scc-complexity.html Expired
8.6 KB
sha256:e61b86ebeefe3cfcaad236c963bfba73957f5e4ae9f447ee221223b21f4ded0f
chef-chef-cli-334-merge-20260414195450-scc-complexity.json Expired
11 KB
sha256:caa62e8fc2c7cb17b9fe836122d5176765603a45de77ec742a69ed9412a0c5e6
chef-chef-cli-334-merge-20260414195450-scc-complexity.txt Expired
768 Bytes
sha256:527212abe713a24f64620ed6ec20f401460c3b3ee22dfe4152cf85f85fad4c32
chef-chef-cli-334-merge-6.1.30-20260414195434-GitHub-sbom.csv
1.21 KB
sha256:4898b27a117f722fd6e0b06052d237c2f9bcd666d8f8e3893ba43d8d7b9a98f6
grype-scan-chef-cli-20260414-195506
2.08 KB
sha256:bb542dd5392787b644cd4e74d43a86e86b358a102b7773cc97cb05b469430d0c
grype-scan-linux-chef-cli-20260414-195439
9.34 KB
sha256:9bc8d59f2b35a5bed52d2327697855fcd6ef3bd106f608da76cf16be425be9dc
grype-scan-windows-chef-cli-20260414-195445
6.68 KB
sha256:2ed43d0bd9f4d940dffabe2b5924b38e68276afa206b3097adc727daf594739c