ci: remove redundant grype install from release-snapshot workflow
The manual grype install (cache + curl-pipe-sh + PATH export) is redundant because anchore/scan-action already bundles grype internally. Removing it also eliminates a supply chain risk: the install script was fetched from the mutable @main branch of anchore/grype via curl | sh, in a job with packages:write and id-token:write permissions.
This commit is contained in:
38
.github/workflows/make.yaml
vendored
38
.github/workflows/make.yaml
vendored
@@ -82,44 +82,6 @@ jobs:
|
|||||||
path: ./
|
path: ./
|
||||||
format: cyclonedx-json
|
format: cyclonedx-json
|
||||||
output-file: sbom.json
|
output-file: sbom.json
|
||||||
- name: Cache grype binary
|
|
||||||
uses: actions/cache@v5
|
|
||||||
id: grype-cache
|
|
||||||
with:
|
|
||||||
path: ~/.local/bin/grype
|
|
||||||
key: grype-${{ runner.os }}-v0.97.1
|
|
||||||
- name: Install grype with retry
|
|
||||||
if: steps.grype-cache.outputs.cache-hit != 'true'
|
|
||||||
id: grype-install
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
GRYPE_VERSION="v0.97.1"
|
|
||||||
GRYPE_DIR="${HOME}/.local/bin"
|
|
||||||
mkdir -p "${GRYPE_DIR}"
|
|
||||||
|
|
||||||
# Download with retry logic
|
|
||||||
MAX_RETRIES=3
|
|
||||||
RETRY_DELAY=10
|
|
||||||
|
|
||||||
for i in $(seq 1 $MAX_RETRIES); do
|
|
||||||
echo "Attempt $i of $MAX_RETRIES: Installing grype ${GRYPE_VERSION}..."
|
|
||||||
if curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b "${GRYPE_DIR}" "${GRYPE_VERSION}"; then
|
|
||||||
echo "Grype installed successfully"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ $i -lt $MAX_RETRIES ]; then
|
|
||||||
echo "Installation failed, retrying in ${RETRY_DELAY} seconds..."
|
|
||||||
sleep $RETRY_DELAY
|
|
||||||
RETRY_DELAY=$((RETRY_DELAY * 2))
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "Failed to install grype after $MAX_RETRIES attempts"
|
|
||||||
exit 1
|
|
||||||
- name: Add grype to PATH
|
|
||||||
run: echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
|
|
||||||
- uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 #v7.3.1
|
- uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 #v7.3.1
|
||||||
with:
|
with:
|
||||||
sbom: "sbom.json"
|
sbom: "sbom.json"
|
||||||
|
|||||||
Reference in New Issue
Block a user