chore: migrate from Trivy to Grype for vulnerability scanning#448
chore: migrate from Trivy to Grype for vulnerability scanning#448
Conversation
Replace aquasecurity/trivy-action with anchore/scan-action (Grype) v7.3.2. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Migrates the repository CI vulnerability scanning workflow from Trivy to Grype (via anchore/scan-action), updating the GitHub Actions security checks accordingly.
Changes:
- Replaced
aquasecurity/trivy-actionwithanchore/scan-actionpinned to v7.3.2. - Updated scan configuration to filesystem path scanning with build-fail thresholds and fixed-only findings.
| uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2 | ||
| id: grype-scan | ||
| with: | ||
| scan-type: 'fs' | ||
| scan-ref: '.' | ||
| scanners: 'vuln,secret,config' | ||
| exit-code: '1' | ||
| ignore-unfixed: 'true' | ||
| severity: 'MEDIUM,HIGH,CRITICAL' | ||
| path: "." | ||
| fail-build: true |
There was a problem hiding this comment.
This migration drops the previous Trivy checks for secret and config scanning (it now runs only Grype vulnerability scanning). If those checks are still desired under this "Security Checks" workflow, add equivalent steps/tools (e.g., a dedicated secret scanner + IaC/config misconfig scanner) or explicitly document that this workflow is now vuln-only to avoid an unintentional security coverage regression.
| - name: Scan repo | ||
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 | ||
| uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2 | ||
| id: grype-scan |
There was a problem hiding this comment.
The step id: grype-scan is currently unused in this workflow. Consider removing it to reduce noise, or use it (e.g., to reference outputs) if you intend to consume scan results later in the job.
| id: grype-scan |
|
I am going to fix the vulns in a next pr |
Summary
aquasecurity/trivy-actionwithanchore/scan-action(Grype) v7.3.2Test plan
🤖 Generated with Claude Code