Problem
The latest main SBOM workflow run succeeded, but its uploaded Grype report contains 67 matches: 30 High, 29 Medium, and 8 Low. There are no Critical findings, so the current workflow stays green and only writes a warning to the step summary.
Run: https://github.com/craft-native/craft/actions/runs/35871502821
The scan step also appends || true to both Grype invocations. A scanner execution or database failure can therefore be hidden; if the JSON is absent or unreadable, later output defaults can make the run appear clean.
Representative High findings include brace-expansion/minimatch paths, Electron comparison tooling, Go stdlib/tool components, extract-zip, and actions/download-artifact metadata. Many are likely developer, benchmark, fixture, or CI-tool paths rather than shipped Craft runtime dependencies, but that distinction is not encoded or reviewed anywhere.
This complements #276, which tracks the narrower bun audit findings in the lockfile.
Expected
- Fail reliably when Grype itself cannot complete or produce valid JSON.
- Define a reviewed policy for High/Critical findings: gate, baseline/allowlist with expiry, or scope the SBOM to shipped artifacts and scan tooling separately.
- Record why retained findings are unreachable or non-shipping.
- Surface new findings as a visible regression instead of allowing an indefinitely green scan.
- Pin or otherwise verify downloaded scanner installers as part of the supply-chain review.
Evidence
The downloaded artifact for run 35871502821 reports severity counts of High=30, Medium=29, Low=8, Critical=0, while the vulnerability-scan job concludes success.
Discovered during the post-merge release audit for #254, #242, and #220.