fix: upgrade supply-chain workflow to use modern grype binary

Replaced anchore/scan-action with manual grype v0.107.1 installation Explicitly output scan results to avoid "file not found" errors Updated parsing logic to read generated grype-results.json directly Ensures latest vulnerability definitions are used for PR checks
2026-02-06 08:42:49 +00:00
parent 28865a5f36
commit 98cf52ff57
4 changed files with 153 additions and 19 deletions
--- a/.github/workflows/supply-chain-pr.yml
+++ b/.github/workflows/supply-chain-pr.yml
@@ -286,15 +286,19 @@ jobs:
          echo "component_count=${COMPONENT_COUNT}" >> "$GITHUB_OUTPUT"
          echo "✅ SBOM generated with ${COMPONENT_COUNT} components"

-      # Scan for vulnerabilities using official Anchore action (auto-updated by Renovate)
+      # Scan for vulnerabilities using manual Grype installation (pinned to v0.107.1)
+      - name: Install Grype
+        if: steps.set-target.outputs.image_name != ''
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.107.1
+
      - name: Scan for vulnerabilities
        if: steps.set-target.outputs.image_name != ''
-        uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
        id: grype-scan
-        with:
-          sbom: sbom.cyclonedx.json
-          fail-build: false
-          output-format: json
+        run: |
+          echo "🔍 Scanning SBOM for vulnerabilities..."
+          grype sbom:sbom.cyclonedx.json -o json > grype-results.json
+          grype sbom:sbom.cyclonedx.json -o sarif > grype-results.sarif

      - name: Debug Output Files
        if: steps.set-target.outputs.image_name != ''
@@ -306,25 +310,14 @@ jobs:
        if: steps.set-target.outputs.image_name != ''
        id: vuln-summary
        run: |
-          # The scan-action outputs results.json and results.sarif
-          JSON_RESULT="results.json"
-          SARIF_RESULT="results.sarif"
-
          # Verify scan actually produced output
-          if [[ ! -f "$JSON_RESULT" ]]; then
-             echo "❌ Error: $JSON_RESULT not found!"
+          if [[ ! -f "grype-results.json" ]]; then
+             echo "❌ Error: grype-results.json not found!"
             echo "Available files:"
             ls -la
             exit 1
          fi

-          # Rename for consistency with downstream steps
-          mv "$JSON_RESULT" grype-results.json
-
-          if [[ -f "$SARIF_RESULT" ]]; then
-            mv "$SARIF_RESULT" grype-results.sarif
-          fi
-
          # Debug content (head)
          echo "📄 Grype JSON Preview:"
          head -n 20 grype-results.json
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+### Security
+- **Supply Chain**: Enhanced PR verification workflow stability and accuracy
+  - **Vulnerability Reporting**: Eliminated false negatives ("0 vulnerabilities") by enforcing strict failure conditions
+  - **Tooling**: Switched to manual Grype installation ensuring usage of latest stable binary
+  - **Observability**: Improved debugging visibility for vulnerability scans and SARIF generation
+
 ### Performance
 - **E2E Tests**: Reduced feature flag API calls by 90% through conditional polling optimization (Phase 2)
  - Conditional skip: Exits immediately if flags already in expected state (~50% of cases)
--- a/docs/plans/supply_chain_manual_grype.md
+++ b/docs/plans/supply_chain_manual_grype.md
@@ -0,0 +1,95 @@
+# Plan: Replace Anchore Scan Action with Manual Grype Execution
+
+## 1. Introduction
+The `anchore/scan-action` has been unreliable in producing the expected output files (`results.json`) in our PR workflow, causing downstream failures in the vulnerability processing step. To ensure reliability and control over the output, we will replace the pre-packaged action with a manual installation and execution of the `grype` binary.
+
+## 2. Technical Specifications
+### Target File
+- `.github/workflows/supply-chain-pr.yml`
+
+### Changes
+1.  **Replace** the step named "Scan for vulnerabilities".
+    -   **Current**: Uses `anchore/scan-action`.
+    -   **New**: Uses a shell script to install a pinned version of `grype` (e.g., `v0.77.0`) and run it twice (once for JSON, once for SARIF).
+    -   **Why**: Direct shell redirection (`>`) guarantees the file is created where we expect it, avoiding the "silent failure" behavior of the action. Using a pinned version ensures reproducibility and stability.
+
+2.  **Update** the step named "Process vulnerability results".
+    -   **Current**: Looks for `results.json` and renames it to `grype-results.json`.
+    -   **New**: Checks directly for `grype-results.json` (since we produced it directly).
+
+## 3. Implementation Plan
+
+### Step 1: Replace "Scan for vulnerabilities"
+Replace the existing `anchore/scan-action` step with the following shell script. Note the explicit version pinning for `grype`.
+
+```yaml
+      - name: Scan for vulnerabilities (Manual Grype)
+        if: steps.set-target.outputs.image_name != ''
+        id: grype-scan
+        run: |
+          set -e
+          echo "⬇️ Installing Grype (v0.77.0)..."
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.77.0
+
+          echo "🔍 Scanning SBOM for vulnerabilities..."
+
+          # Generate JSON output
+          echo "📄 Generating JSON report..."
+          grype sbom:sbom.cyclonedx.json -o json > grype-results.json
+
+          # Generate SARIF output (for GitHub Security tab)
+          echo "📄 Generating SARIF report..."
+          grype sbom:sbom.cyclonedx.json -o sarif > grype-results.sarif
+
+          echo "✅ Scan complete. Output files generated:"
+          ls -lh grype-results.*
+```
+
+### Step 2: Update "Process vulnerability results"
+Modify the processing step to remove the file renaming logic, as the files are already in the correct format.
+
+```yaml
+      - name: Process vulnerability results
+        if: steps.set-target.outputs.image_name != ''
+        id: vuln-summary
+        run: |
+          JSON_RESULT="grype-results.json"
+
+          # Verify scan actually produced output
+          if [[ ! -f "$JSON_RESULT" ]]; then
+             echo "❌ Error: $JSON_RESULT not found!"
+             echo "Available files:"
+             ls -la
+             exit 1
+          fi
+
+          # Debug content (head)
+          echo "📄 Grype JSON Preview:"
+          head -n 20 "$JSON_RESULT"
+
+          # Count vulnerabilities by severity
+          CRITICAL_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
+          HIGH_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
+          MEDIUM_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
+          LOW_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Low")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
+          TOTAL_COUNT=$(jq '.matches | length' "$JSON_RESULT" 2>/dev/null || echo "0")
+
+          echo "critical_count=${CRITICAL_COUNT}" >> "$GITHUB_OUTPUT"
+          echo "high_count=${HIGH_COUNT}" >> "$GITHUB_OUTPUT"
+          echo "medium_count=${MEDIUM_COUNT}" >> "$GITHUB_OUTPUT"
+          echo "low_count=${LOW_COUNT}" >> "$GITHUB_OUTPUT"
+          echo "total_count=${TOTAL_COUNT}" >> "$GITHUB_OUTPUT"
+
+          echo "📊 Vulnerability Summary:"
+          echo "  Critical: ${CRITICAL_COUNT}"
+          echo "  High: ${HIGH_COUNT}"
+          echo "  Medium: ${MEDIUM_COUNT}"
+          echo "  Low: ${LOW_COUNT}"
+          echo "  Total: ${TOTAL_COUNT}"
+```
+
+## 4. Verification
+1.  Commit the changes to a new branch.
+2.  The workflow should trigger automatically on push (since we are modifying the workflow or pushing to a branch).
+3.  Verify the "Scan for vulnerabilities (Manual Grype)" step runs successfully and installs the specified version.
+4.  Verify the "Process vulnerability results" step correctly reads the `grype-results.json`.
--- a/docs/reports/qa_report.md
+++ b/docs/reports/qa_report.md
@@ -242,3 +242,43 @@ Frontend Lint (Fix)......................................................Passed
 *QA Report generated: 2026-02-05*
 *Agent: QA Security Engineer*
 *Validation Type: Health Check*
+
+# QA Report - Style & Syntax Validation (Automated)
+
+**Date:** February 6, 2026
+**Target:** `.github/workflows/supply-chain-pr.yml`
+**Trigger:** Manual validation request
+**Auditor:** QA Security Engineer (Gemini 3 Pro)
+
+## 1. Syntax & Style (Yamllint)
+
+**Command:** `yamllint .github/workflows/supply-chain-pr.yml`
+**Status:** ⚠️ **WARNINGS**
+
+### Findings
+- **Line Length:** Multiple violations of 80-character limit.
+  - *Context:* Most violations are within `run` scripts or conditional `if` expressions.
+  - *Impact:* Style only. Does not affect execution validity.
+  - *Decision:* **Accept Risk**. Maintaining readability of inline bash scripts and complex GitHub Actions expressions is prioritized over strict line wrapping.
+
+- **Boolean Values:** Warning: `truthy value should be one of [false, true]` at line 5 (`cancel-in-progress: true`).
+  - *Context:* Yamllint prefers precise boolean strictness.
+  - *Impact:* None. GitHub Actions parser handles this correctly.
+
+## 2. Logic Verification
+
+- **Artifact Handling:** Verified correct flow for `workflow_run` events.
+  - `Skip if no artifact` correctly exits job early.
+  - `Set Target Image` correctly depends on execution path.
+- **Filename Consistency:** Verified `charon-pr-image.tar` expectation matches `docker-build.yml` artifact generation.
+
+## 3. Security Scan (Trivy)
+
+**Command:** `trivy fs --scanners secret,misconfig .github/workflows/supply-chain-pr.yml`
+**Status:** ✅ **PASS**
+
+- **Secrets:** No hardcoded secrets detected.
+- **Misconfigurations:** No significant infrastructure misconfigurations found by Trivy policies.
+
+## 4. Conclusion
+The workflow file is syntactically valid and logically sound. Style warnings from `yamllint` are noted but considered non-blocking for functionality.