local-deep-research/.github/workflows/grype.yml

name: Grype Vulnerability Scan

# Second dependency/container vulnerability scanner (complements Trivy).
# Grype uses Anchore's curated vulnerability DB (NVD, GitHub Advisories,
# Alpine SecDB, etc.) — a different data source from Trivy's own aggregation.
# Running both is standard practice: they catch different CVEs.

on:
  workflow_call:  # Called by release-gate.yml
  workflow_dispatch:

permissions: {}  # Minimal top-level for OSSF Scorecard Token-Permissions

jobs:
  grype-filesystem:
    name: Grype Filesystem Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
      actions: read

    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false

    - name: Run Grype filesystem scan
      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
      id: grype-fs
      with:
        path: '.'
        # DO NOT change to fail-build: true — findings are enforced via SARIF alerts
        # in the release gate (check-code-scanning-alerts job in release-gate.yml).
        # Failing here would break CI without adding security value.
        fail-build: false
        output-format: sarif
        severity-cutoff: medium

    - name: Ensure SARIF file exists
      if: always()
      run: |
        SARIF_FILE="${{ steps.grype-fs.outputs.sarif }}"
        if [ ! -f "$SARIF_FILE" ]; then
          echo "::warning::Grype filesystem scan did not produce a SARIF file - creating empty placeholder"
          cat > "$SARIF_FILE" << 'SARIF'
        {
          "version": "2.1.0",
          "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
          "runs": [{
            "tool": {
              "driver": {
                "name": "Grype",
                "informationUri": "https://github.com/anchore/grype",
                "rules": []
              }
            },
            "results": []
          }]
        }
        SARIF
        fi

    - name: Upload Grype filesystem SARIF to GitHub Security tab
      uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
      if: always()
      with:
        sarif_file: ${{ steps.grype-fs.outputs.sarif }}
        category: grype-filesystem

  grype-container:
    name: Grype Container Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
      actions: read

    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
      with:
        egress-policy: audit

    - name: Free up disk space
      run: |
        sudo rm -rf /usr/share/dotnet
        sudo rm -rf /usr/local/lib/android
        sudo rm -rf /opt/ghc
        sudo rm -rf /opt/hostedtoolcache/CodeQL
        sudo docker image prune -af
        df -h

    - name: Checkout code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

    - name: Build Docker image for scanning
      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
      with:
        context: .
        push: false
        load: true
        tags: local-deep-research:grype-scan
        cache-from: type=gha,scope=grype-scan
        cache-to: type=gha,mode=max,scope=grype-scan

    - name: Run Grype container scan
      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
      id: grype-container
      with:
        image: 'local-deep-research:grype-scan'
        # DO NOT change to fail-build: true — findings are enforced via SARIF alerts
        # in the release gate (check-code-scanning-alerts job in release-gate.yml).
        # Failing here would break CI without adding security value.
        fail-build: false
        output-format: sarif
        severity-cutoff: medium

    - name: Ensure SARIF file exists
      if: always()
      run: |
        SARIF_FILE="${{ steps.grype-container.outputs.sarif }}"
        if [ ! -f "$SARIF_FILE" ]; then
          echo "::warning::Grype container scan did not produce a SARIF file - creating empty placeholder"
          cat > "$SARIF_FILE" << 'SARIF'
        {
          "version": "2.1.0",
          "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
          "runs": [{
            "tool": {
              "driver": {
                "name": "Grype",
                "informationUri": "https://github.com/anchore/grype",
                "rules": []
              }
            },
            "results": []
          }]
        }
        SARIF
        fi

    - name: Upload Grype container SARIF to GitHub Security tab
      uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
      if: always()
      with:
        sarif_file: ${{ steps.grype-container.outputs.sarif }}
        category: grype-container

    - name: Display Grype summary
      if: always()
      run: |
        {
          echo "## Grype Container Vulnerability Scan"
          echo ""
          echo "✅ Grype scan completed - Results available in Security tab"
        } >> "$GITHUB_STEP_SUMMARY"