Skip to content

fix(release): accept current Grype database schema - #533

Merged
jeremi merged 1 commit into
mainfrom
codex/normalize-grype-db-schema
Jul 28, 2026
Merged

jeremi merged 1 commit into
mainfrom
codex/normalize-grype-db-schema

Conversation

@jeremi

@jeremi jeremi commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

  • accept the nested database descriptor emitted by pinned Grype v0.114 while retaining legacy compatibility
  • extract database freshness and checksum from either supported schema
  • keep the reviewed advisory policy as the blocking vulnerability decision

Failure evidence

Candidate run 30354311463 produced a complete report and Grype exited 0, but the workflow rejected it because it expected the former flat descriptor.db.built and descriptor.db.checksum fields. Grype v0.114 emits these under descriptor.db.status, with the checksum in the database source URL.

Verification

  • python3 release/scripts/test_registry_release.py (92 passed)
  • python3 release/scripts/check-gates-inventory.py (168 gates passed)
  • release candidate workflow YAML parsed successfully
  • metadata extraction verified against the actual v0.114 report from the failed candidate
  • git diff --check

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
@jeremi
jeremi merged commit efdb1c0 into main Jul 28, 2026
29 checks passed
@jeremi
jeremi deleted the codex/normalize-grype-db-schema branch July 28, 2026 11:51

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ec8fb0f5a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

(.descriptor.db.built | type == "string") and
(.descriptor.db.checksum | type == "string")
(
(.descriptor.db.built // .descriptor.db.status.built)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the required DCO sign-off

Commit 1090e1c71174fe40bdf6ba250572a08d610b31fe has no Signed-off-by: trailer, so it does not satisfy the repository's mandatory DCO policy and cannot be accepted as submitted; recreate the commit with a matching sign-off before merging.

AGENTS.md reference: AGENTS.md:L68-L70

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant