Summary
- Fail when Grype cannot run successfully or returns missing, malformed or structurally invalid output. Validate the database state and reject empty inventories.
- Derive text and severity counts from one JSON scan instead of executing two independent scans and defaulting errors to zero.
- Pin Syft 1.52.0 and Grype 0.119.0 Linux x64 release downloads by SHA-256; stop piping mutable installer scripts into a shell.
- Retain diagnostic artifacts when scans fail and document the current policy accurately.
Partially addresses #279. This does not close that issue: the reviewed High/Critical policy, shipping-scope assessment and dependency remediation remain outstanding. No vulnerability exemptions are introduced.
Validation
- Four regression tests cover scanner failure with stale output, successful exits with absent/broken reports, invalid database metadata, empty inventories, severity counting and consistent text output.
- The report parser reproduces the existing real artifact counts exactly: 0 Critical, 30 High, 29 Medium, 8 Low.
- Focused Pickier and diff checks pass.
- The pre-existing obsolete release-upload action is removed separately by #294; the combined workflows will receive final Actionlint validation after merge.