Feat: Add grype_enabled input to skip the scan

[ModeSevenIndustrialSolutions]

Summary

Adds grype_enabled (boolean, default: true) to both lanes, so callers can skip the Grype scan without losing the SBOM — and hardens the release gates so a skipped scan cannot be confused with a failed one.

Why

Nothing in the estate could skip Grype. The job hung off the SBOM job:

grype:
needs: 'sbom'if: ${{ !cancelled() && needs.sbom.result == 'success' }}

So the only escape hatch was sbom_enabled: false, which skips the SBOM and silently takes Grype with it — exactly backwards, since SBOM generation is the part we want on by default.

grype_enabled decouples them. The decoupling is deliberately one-way: disabling the scan keeps the SBOM, but disabling the SBOM also stops the scan, which has nothing to read.

Changes

• grype_enabled input added to build-test.yaml and build-test-release.yaml
• Grype job gate extended with && inputs.grype_enabled
• sbom_enabled description reworded — it previously read "set false to skip SBOM and Grype jobs", implying deliberate coupling
• README.md input table documents grype_enabled and the corrected sbom_enabled description
• examples/build-test/github.yaml documents both toggles

Release gate hardening (added after review)

The tests and attach-artefacts jobs gated on:

contains(fromJSON('["success", "skipped"]'), needs.grype.result)

That accepts every skip as benign, but skipped is ambiguous. Grype skips both when a toggle disables it and when the sbom job fails — so a failed SBOM would have let the release tests run, and attach-artefacts promote, with no scan performed at all.

This idiom pre-dates this PR. It was latent because a skipped Grype previously required an SBOM failure; grype_enabled makes that state routine and configuration-reachable, so leaving it would mean shipping a known hole behind a newly-common path. Now:

&& (needs.grype.result == 'success'|| (needs.grype.result == 'skipped'&& (!inputs.grype_enabled || !inputs.sbom_enabled)))

A skip is accepted only when a toggle explains it. The Grype clause tests both toggles because either legitimately produces the skip. The same treatment is applied to the audit and sbom clauses on both gates.

Credit to Copilot for spotting this on the companion PRs.

Compatibility

default: true — no existing caller changes behaviour. No inputs removed or renamed. The gate change is strictly more conservative: it can only block where it previously allowed, and only when a scan genuinely did not run.

Validation

• yamllint, actionlint — clean
• zizmor --persona=auditor — no new findings
• markdown-table-fixer lint README.md --auto-fix — clean
• Full prek run over the changed files — all hooks passed

Follow-up

lfreleng-actions/workflows-template#57 tracks end-to-end coverage of the opt-out paths.

Context

Part of a seven-PR series standardising these toggles across the workflow estate. Companions: lfreleng-actions/workflows-template#56, lfreleng-actions/python-workflows#85, lfreleng-actions/go-workflows#67, lfreleng-actions/java-workflows#45, lfreleng-actions/docker-workflows#68.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an independent Grype scan toggle while preserving SBOM generation by default.

Changes:

• Adds grype_enabled, defaulting to true.
• Gates Grype jobs on the new input.
• Documents toggles in the build-test example.

File summaries

File	Description
.github/workflows/build-test.yaml	Adds and applies the Grype toggle.
.github/workflows/build-test-release.yaml	Adds the toggle with skip-safe downstream gates.
examples/build-test/github.yaml	Shows both SBOM and Grype controls.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/build-test.yaml:130

• The canonical README.md input table lists the public build-test.yaml inputs, and the release workflow documentation says it inherits that table, but grype_enabled is absent. Add it next to sbom_enabled so callers can discover the new toggle without relying on a single example file.

 grype_enabled:

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

.github/workflows/build-test.yaml:130

• The repository's integration workflow calls build-test.yaml in a fixture matrix (.github/workflows/testing.yaml:88-95), but no leg passes grype_enabled: false. Add coverage for the new branch that confirms the workflow completes with Grype disabled while the sbom-files artifact is still produced.

 grype_enabled:

.github/workflows/build-test.yaml:134

• This describes the controls as independent, but the Grype job still requires needs.sbom.result == 'success', so sbom_enabled: false always prevents Grype from running. Phrase this as one-way decoupling so callers do not infer that Grype can run without SBOM generation.

 Run the Grype vulnerability scan over the generated SBOM (set
false to skip). Independent of sbom_enabled, so the SBOM is
still produced and published when the scan is disabled.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[zxiiro]

🤖 Auto-approved by agent: reviewed workflow/code change for security and CI/CD impact, found low risk. Adds additive grype_enabled input defaulting to true and tightens skip-vs-fail gating so a failed SBOM cannot look like an intentional skip.