ci: remove redundant grype install from release-snapshot workflow

The manual grype install (cache + curl-pipe-sh + PATH export) is redundant
because anchore/scan-action already bundles grype internally. Removing it
also eliminates a supply chain risk: the install script was fetched from
the mutable @main branch of anchore/grype via curl | sh, in a job with
packages:write and id-token:write permissions.
This commit is contained in:
mendral-app[bot]
2026-03-11 05:28:01 -07:00
committed by GitHub
parent 73ba7aab63
commit 76e1c17a24

View File

@@ -82,44 +82,6 @@ jobs:
path: ./
format: cyclonedx-json
output-file: sbom.json
- name: Cache grype binary
uses: actions/cache@v5
id: grype-cache
with:
path: ~/.local/bin/grype
key: grype-${{ runner.os }}-v0.97.1
- name: Install grype with retry
if: steps.grype-cache.outputs.cache-hit != 'true'
id: grype-install
shell: bash
run: |
set -euo pipefail
GRYPE_VERSION="v0.97.1"
GRYPE_DIR="${HOME}/.local/bin"
mkdir -p "${GRYPE_DIR}"
# Download with retry logic
MAX_RETRIES=3
RETRY_DELAY=10
for i in $(seq 1 $MAX_RETRIES); do
echo "Attempt $i of $MAX_RETRIES: Installing grype ${GRYPE_VERSION}..."
if curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b "${GRYPE_DIR}" "${GRYPE_VERSION}"; then
echo "Grype installed successfully"
exit 0
fi
if [ $i -lt $MAX_RETRIES ]; then
echo "Installation failed, retrying in ${RETRY_DELAY} seconds..."
sleep $RETRY_DELAY
RETRY_DELAY=$((RETRY_DELAY * 2))
fi
done
echo "Failed to install grype after $MAX_RETRIES attempts"
exit 1
- name: Add grype to PATH
run: echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
- uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 #v7.3.1
with:
sbom: "sbom.json"