From d9efcd8a264c4346d5d7879628b55a1e0a74c70c Mon Sep 17 00:00:00 2001 From: Alex Pyrgiotis Date: Mon, 28 Apr 2025 14:54:55 +0300 Subject: [PATCH] Retain Grype ignore list from current branch When security scanning our poetry.lock file for the **released** Dangerzone version, retain the Grype ignore list (.grype.yaml) of the current branch, which would be otherwise overwritten by a git checkout to the latest released tag (v0.9.0 as of writing this). This way, we can instruct Grype to ignore vulnerabilities in the latest Dangerzone release. --- .github/workflows/scan_released.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/scan_released.yml b/.github/workflows/scan_released.yml index 401d2a3..5fdc499 100644 --- a/.github/workflows/scan_released.yml +++ b/.github/workflows/scan_released.yml @@ -67,8 +67,12 @@ jobs: fetch-depth: 0 - name: Checkout the latest released tag run: | + # Grab the latest Grype ignore list before git checkout overwrites it. + cp .grype.yaml .grype.yaml.new VERSION=$(curl https://api.github.com/repos/freedomofpress/dangerzone/releases/latest | jq -r '.tag_name') git checkout $VERSION + # Restore the newest Grype ignore list. + mv .grype.yaml.new .grype.yaml # NOTE: Scan first without failing, else we won't be able to read the scan # report. - name: Scan application (no fail)