Charon/docs/plans/archive/supply_chain_manual_grype.md

Plan: Replace Anchore Scan Action with Manual Grype Execution

1. Introduction

The anchore/scan-action has been unreliable in producing the expected output files (results.json) in our PR workflow, causing downstream failures in the vulnerability processing step. To ensure reliability and control over the output, we will replace the pre-packaged action with a manual installation and execution of the grype binary.

2. Technical Specifications

Target File

• .github/workflows/supply-chain-pr.yml

Changes

1. Replace the step named "Scan for vulnerabilities".

   • Current: Uses anchore/scan-action.
   • New: Uses a shell script to install a pinned version of grype (e.g., v0.77.0) and run it twice (once for JSON, once for SARIF).
   • Why: Direct shell redirection (>) guarantees the file is created where we expect it, avoiding the "silent failure" behavior of the action. Using a pinned version ensures reproducibility and stability.

2. Update the step named "Process vulnerability results".

   • Current: Looks for results.json and renames it to grype-results.json.
   • New: Checks directly for grype-results.json (since we produced it directly).

3. Implementation Plan

Step 1: Replace "Scan for vulnerabilities"

Replace the existing anchore/scan-action step with the following shell script. Note the explicit version pinning for grype.

      - name: Scan for vulnerabilities (Manual Grype)
        if: steps.set-target.outputs.image_name != ''
        id: grype-scan
        run: |
          set -e
          echo "⬇️ Installing Grype (v0.77.0)..."
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.77.0

          echo "🔍 Scanning SBOM for vulnerabilities..."

          # Generate JSON output
          echo "📄 Generating JSON report..."
          grype sbom:sbom.cyclonedx.json -o json > grype-results.json

          # Generate SARIF output (for GitHub Security tab)
          echo "📄 Generating SARIF report..."
          grype sbom:sbom.cyclonedx.json -o sarif > grype-results.sarif

          echo "✅ Scan complete. Output files generated:"
          ls -lh grype-results.*

Step 2: Update "Process vulnerability results"

Modify the processing step to remove the file renaming logic, as the files are already in the correct format.

      - name: Process vulnerability results
        if: steps.set-target.outputs.image_name != ''
        id: vuln-summary
        run: |
          JSON_RESULT="grype-results.json"

          # Verify scan actually produced output
          if [[ ! -f "$JSON_RESULT" ]]; then
             echo "❌ Error: $JSON_RESULT not found!"
             echo "Available files:"
             ls -la
             exit 1
          fi

          # Debug content (head)
          echo "📄 Grype JSON Preview:"
          head -n 20 "$JSON_RESULT"

          # Count vulnerabilities by severity
          CRITICAL_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
          HIGH_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
          MEDIUM_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
          LOW_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Low")] | length' "$JSON_RESULT" 2>/dev/null || echo "0")
          TOTAL_COUNT=$(jq '.matches | length' "$JSON_RESULT" 2>/dev/null || echo "0")

          echo "critical_count=${CRITICAL_COUNT}" >> "$GITHUB_OUTPUT"
          echo "high_count=${HIGH_COUNT}" >> "$GITHUB_OUTPUT"
          echo "medium_count=${MEDIUM_COUNT}" >> "$GITHUB_OUTPUT"
          echo "low_count=${LOW_COUNT}" >> "$GITHUB_OUTPUT"
          echo "total_count=${TOTAL_COUNT}" >> "$GITHUB_OUTPUT"

          echo "📊 Vulnerability Summary:"
          echo "  Critical: ${CRITICAL_COUNT}"
          echo "  High: ${HIGH_COUNT}"
          echo "  Medium: ${MEDIUM_COUNT}"
          echo "  Low: ${LOW_COUNT}"
          echo "  Total: ${TOTAL_COUNT}"

4. Verification

1. Commit the changes to a new branch.
2. The workflow should trigger automatically on push (since we are modifying the workflow or pushing to a branch).
3. Verify the "Scan for vulnerabilities (Manual Grype)" step runs successfully and installs the specified version.
4. Verify the "Process vulnerability results" step correctly reads the grype-results.json.