From 76e1c17a24cfb2d79dc562435094139ae4ddf313 Mon Sep 17 00:00:00 2001
From: "mendral-app[bot]" <233154221+mendral-app[bot]@users.noreply.github.com>
Date: Wed, 11 Mar 2026 05:28:01 -0700
Subject: [PATCH] ci: remove redundant grype install from release-snapshot
 workflow

The manual grype install (cache + curl-pipe-sh + PATH export) is redundant
because anchore/scan-action already bundles grype internally. Removing it
also eliminates a supply chain risk: the install script was fetched from
the mutable @main branch of anchore/grype via curl | sh, in a job with
packages:write and id-token:write permissions.
---
 .github/workflows/make.yaml | 38 -------------------------------------
 1 file changed, 38 deletions(-)

diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml
index 5a19d5ba7..e1c05f157 100644
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -82,44 +82,6 @@ jobs:
           path: ./
           format: cyclonedx-json
           output-file: sbom.json
-      - name: Cache grype binary
-        uses: actions/cache@v5
-        id: grype-cache
-        with:
-          path: ~/.local/bin/grype
-          key: grype-${{ runner.os }}-v0.97.1
-      - name: Install grype with retry
-        if: steps.grype-cache.outputs.cache-hit != 'true'
-        id: grype-install
-        shell: bash
-        run: |
-          set -euo pipefail
-          GRYPE_VERSION="v0.97.1"
-          GRYPE_DIR="${HOME}/.local/bin"
-          mkdir -p "${GRYPE_DIR}"
-
-          # Download with retry logic
-          MAX_RETRIES=3
-          RETRY_DELAY=10
-
-          for i in $(seq 1 $MAX_RETRIES); do
-            echo "Attempt $i of $MAX_RETRIES: Installing grype ${GRYPE_VERSION}..."
-            if curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b "${GRYPE_DIR}" "${GRYPE_VERSION}"; then
-              echo "Grype installed successfully"
-              exit 0
-            fi
-
-            if [ $i -lt $MAX_RETRIES ]; then
-              echo "Installation failed, retrying in ${RETRY_DELAY} seconds..."
-              sleep $RETRY_DELAY
-              RETRY_DELAY=$((RETRY_DELAY * 2))
-            fi
-          done
-
-          echo "Failed to install grype after $MAX_RETRIES attempts"
-          exit 1
-      - name: Add grype to PATH
-        run: echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
       - uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 #v7.3.1
         with:
           sbom: "sbom.json"