From 72ec60ebc9889775596ea200ea9cd93c2cf67e95 Mon Sep 17 00:00:00 2001 From: Coding-Dev-Tools Date: Tue, 8 Sep 2026 07:48:02 -0400 Subject: [PATCH] fix(release): pin grype evidence scanner --- .github/workflows/release.yml | 3 +++ tests/test_release_infrastructure.py | 1 + 2 files changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0106bac3..6afbc5db 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -589,6 +589,9 @@ jobs: uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2 with: image: engraphis:release + # Keep the scanner version aligned with the public evidence schema + # and its fail-closed validation in scripts/release_evidence.py. + grype-version: v0.110.0 fail-build: false severity-cutoff: high only-fixed: true diff --git a/tests/test_release_infrastructure.py b/tests/test_release_infrastructure.py index cc1fabc9..075c0ad7 100644 --- a/tests/test_release_infrastructure.py +++ b/tests/test_release_infrastructure.py @@ -226,6 +226,7 @@ def test_ci_and_release_audit_production_image_dependencies(): assert "docker compose config --quiet" in release_docker assert "Audit production image dependencies" in release_docker assert "pip-audit==2.10.1" in release_docker + assert "grype-version: v0.110.0" in release_docker assert 'docker create --name "$container" engraphis:release' in release_docker assert 'docker cp "$container:$site_packages/."' in release_docker assert legacy_audit_path not in release_docker