From a06bd6183babb15e7baa899f4c423c39454e5fc9 Mon Sep 17 00:00:00 2001 From: Wesley Ellis Date: Tue, 21 Jul 2026 13:30:40 -0400 Subject: [PATCH 1/2] Upgrade grype to fix DB migration failure Bump anchore/scan-action from v6.5.0 to v7.4.0 and pin grype-version to v0.116.0 to resolve the scheduled scan failure caused by the v6.1.9 vulnerability DB not being migratable by older grype (anchore/grype#3586). --- .github/workflows/grype.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/grype.yml b/.github/workflows/grype.yml index 6e91c38..855a963 100644 --- a/.github/workflows/grype.yml +++ b/.github/workflows/grype.yml @@ -27,12 +27,13 @@ jobs: token: ${{ secrets.ORG_GITHUB_TOKEN }} - name: Scan id: scan - uses: anchore/scan-action@df395807f4554463d4455b8047cf58e37b6acaae # v6.5.0 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 with: path: "." only-fixed: true output-format: json fail-build: false + grype-version: v0.116.0 - name: Upload results to OpsLevel run: | jq '{"matches": .matches}' "${{ steps.scan.outputs.json }}" | From 8bfaa751842df9115f6820cd08ec6599b6d8b6a9 Mon Sep 17 00:00:00 2001 From: Wesley Ellis Date: Tue, 21 Jul 2026 13:45:32 -0400 Subject: [PATCH 2/2] Fix setup-cli version pinning The install command referenced ${{ inputs.version }}, but the input is named cli_version, so the version was always empty and the CLI defaulted to latest. Also forward the arg to the script via 'sh -s --' instead of passing it to sh itself. --- setup-cli/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup-cli/action.yml b/setup-cli/action.yml index 98ac08b..9b34dde 100644 --- a/setup-cli/action.yml +++ b/setup-cli/action.yml @@ -19,4 +19,4 @@ runs: - name: Install OpsLevel cli shell: bash run: | - curl -sLS https://raw.githubusercontent.com/OpsLevel/cli/main/install.sh ${{ inputs.version }} | sh + curl -sLS https://raw.githubusercontent.com/OpsLevel/cli/main/install.sh | sh -s -- ${{ inputs.cli_version }}