Upgrade grype to fix DB migration failure and fix setup-cli action when cli_version specified#12
Merged
Merged
Conversation
Bump anchore/scan-action from v6.5.0 to v7.4.0 and pin grype-version to v0.116.0 to resolve the scheduled scan failure caused by the v6.1.9 vulnerability DB not being migratable by older grype (anchore/grype#3586).
The install command referenced ${{ inputs.version }}, but the input is
named cli_version, so the version was always empty and the CLI defaulted
to latest. Also forward the arg to the script via 'sh -s --' instead of
passing it to sh itself.
Farjaad
approved these changes
Jul 21, 2026
wesleyjellis
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR was written by Claude.
Summary
The scheduled Grype security scan is failing across consuming repos with:
example
This is upstream Grype bug anchore/grype#3586: the newly published vulnerability DB (schema v6.1.9) cannot be migrated by older Grype versions. Our
grype.ymlusedanchore/scan-action@v6.5.0, which defaults to installing Grype v0.96.1.Changes
anchore/scan-actionfromv6.5.0(df395807...) tov7.4.0(e1165082ffb1fe366ebaf02d8526e7c4989ea9d2), updating both the pinned SHA and the trailing# vX.Y.Zcomment.grype-version: v0.116.0to the Scan step so we control the Grype version explicitly rather than relying on the action default. v0.116.0 contains the fix for Issue Pulling DB update anchore/grype#3586.The
grype-versioninput name was verified againstaction.ymlinanchore/scan-action@v7.4.0. All other inputs (path,only-fixed,output-format,fail-build) and the upload step are unchanged.Breaking changes
None affecting this workflow. The v6→v7 major bump carried no input/runtime/behavior changes in its release notes (just a Grype dependency bump). The only runtime change across the range is
node20→node24(v7.4.0), which is handled transparently by GitHub-hosted runners. No inputs we use were removed or renamed; thejsonoutput consumed by the upload step is unchanged.Test Plan
main.OpsLevel/OpsLevel), re-run the Security - Grype Scan Repo workflow (via the scheduled trigger, or manually re-run the latest failed run of the Security scan).unable to migrate: constraint failed: UNIQUE constraint failed: operating_systems...error and thatloaded DB status=valid.v0.116.0(visible in the step logs) and completes with a zero exit status.CI fixes / setup-cli
It also seems like the
setup-cliaction was broken since always as it was using a different parameter in the action body than the input was declared.