CP-47362: Report grype findings in the CI log - #1003
Merged
Conversation
This was referenced Sep 4, 2026
Greptile SummaryThe PR makes high-severity image-scan findings visible in CI logs while retaining the existing failure behavior, and updates the bundled Prometheus config reloader and its vulnerability override.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Important Files Changed
Reviews (7): Last reviewed commit: "CP-47363: Upgrade prometheus-config-relo..." | Re-trigger Greptile |
amfelso
approved these changes
Sep 4, 2026
evan-cz
force-pushed
the
CP-47362-grype-output
branch
2 times, most recently
from
September 4, 2026 18:03
a663d19 to
12ed1bf
Compare
Contributor
Author
|
Rebuilding against the re-tagged |
evan-cz
force-pushed
the
CP-47362-grype-output
branch
from
September 4, 2026 18:41
12ed1bf to
12597b4
Compare
evan-cz
force-pushed
the
CP-47350-go-1267
branch
from
September 4, 2026 18:41
05db3f6 to
42d7332
Compare
evan-cz
force-pushed
the
CP-47362-grype-output
branch
from
September 4, 2026 18:59
12597b4 to
bf342e4
Compare
Makes a failing image scan say what it found. The scan action defaults to writing SARIF to a temporary file and printing nothing, so a failure reports only that findings exist at or above the threshold. The file is discarded when the runner is torn down, leaving no way to learn which package or advisory tripped the gate short of reproducing the scan locally against a private registry. Nothing in either workflow consumes the SARIF, so the format is switched to the table, which the action writes to the step log. Applied to the pull request gate and the scheduled image scan, which had the same default. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
evan-cz
force-pushed
the
CP-47362-grype-output
branch
from
September 4, 2026 20:53
bf342e4 to
2c0db27
Compare
evan-cz
force-pushed
the
CP-47350-go-1267
branch
from
September 4, 2026 20:53
42d7332 to
09280a7
Compare
Brings the bundled config reloader up two minor versions, from v0.91.0, picking up upstream's own dependency work and clearing the three high-severity x/crypto findings that were blocking the image scan. This binary is built from upstream prometheus-operator source, so its dependency versions are upstream's rather than this repository's, and the build carries go get overrides for the ones upstream has not caught up on. Those overrides name exact versions, so each goes stale as new advisories land against the version it names. That had already happened: the override named x/crypto v0.53.0, which has since had three advisories filed against it, so the line written to clear findings had become the reason for them. Upgrading lets two of the three surviving overrides go. Upstream now ships x/net v0.57.0 and x/text v0.40.0, both ahead of what the old pins asked for, so keeping those would have downgraded them. Only x/crypto still needs raising. No etcd override is added. The image scan reports an etcd advisory, but that dependency reaches the image through the bundled Alloy binary rather than this one, so an override here cannot affect it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1001.
A failing image scan currently reports only that findings exist at or above the threshold, never which package or advisory tripped it.
anchore/scan-actiondefaults to writing SARIF to a temporary file and printing nothing; nothing in either workflow consumes that file, and the runner discards it when the job ends.Diagnosing a failure therefore means reproducing the scan locally against a private registry — which needs a working Docker daemon and registry credentials, and silently produces an empty catalogue when either is missing. An empty catalogue reads as a clean result, which is actively misleading.
Setting
output-format: tableputs the findings in the step log. Applied to both the pull request gate and the scheduled scan inscan-images.yml, which had the same default.No functional change to what is scanned or what fails the build.
🤖 Generated with Claude Code