ci: remove redundant grype install from release-snapshot workflow
The manual grype install (cache + curl-pipe-sh + PATH export) is redundant because anchore/scan-action already bundles grype internally. Removing it also eliminates a supply chain risk: the install script was fetched from the mutable @main branch of anchore/grype via curl | sh, in a job with packages:write and id-token:write permissions.
This commit is contained in:
38
.github/workflows/make.yaml
vendored
38
.github/workflows/make.yaml
vendored
@@ -82,44 +82,6 @@ jobs:
|
||||
path: ./
|
||||
format: cyclonedx-json
|
||||
output-file: sbom.json
|
||||
- name: Cache grype binary
|
||||
uses: actions/cache@v5
|
||||
id: grype-cache
|
||||
with:
|
||||
path: ~/.local/bin/grype
|
||||
key: grype-${{ runner.os }}-v0.97.1
|
||||
- name: Install grype with retry
|
||||
if: steps.grype-cache.outputs.cache-hit != 'true'
|
||||
id: grype-install
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
GRYPE_VERSION="v0.97.1"
|
||||
GRYPE_DIR="${HOME}/.local/bin"
|
||||
mkdir -p "${GRYPE_DIR}"
|
||||
|
||||
# Download with retry logic
|
||||
MAX_RETRIES=3
|
||||
RETRY_DELAY=10
|
||||
|
||||
for i in $(seq 1 $MAX_RETRIES); do
|
||||
echo "Attempt $i of $MAX_RETRIES: Installing grype ${GRYPE_VERSION}..."
|
||||
if curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b "${GRYPE_DIR}" "${GRYPE_VERSION}"; then
|
||||
echo "Grype installed successfully"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ $i -lt $MAX_RETRIES ]; then
|
||||
echo "Installation failed, retrying in ${RETRY_DELAY} seconds..."
|
||||
sleep $RETRY_DELAY
|
||||
RETRY_DELAY=$((RETRY_DELAY * 2))
|
||||
fi
|
||||
done
|
||||
|
||||
echo "Failed to install grype after $MAX_RETRIES attempts"
|
||||
exit 1
|
||||
- name: Add grype to PATH
|
||||
run: echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
|
||||
- uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 #v7.3.1
|
||||
with:
|
||||
sbom: "sbom.json"
|
||||
|
||||
Reference in New Issue
Block a user