Feat: Add grype_enabled input to skip the scan

.github/workflows/build-test-multiarch.yaml

@@ -168,8 +168,9 @@ on:
       # --- SBOM ---
       sbom_enabled:
         description: >-
-          Generate an SBOM (set false to skip; also skips the
-          dependent Grype scan)
+          Generate an SBOM (set false to skip). The Grype scan
+          reads the SBOM, so skipping generation leaves it nothing to
+          scan. To keep the SBOM but drop the scan, use grype_enabled.
         required: false
         type: boolean
         default: true
@@ -185,6 +186,15 @@ on:
         default: 'both'
 
       # --- Grype scan ---
+      grype_enabled:
+        description: >-
+          Run the Grype vulnerability scan over the generated SBOM (set
+          false to skip). Decoupling is one-way: disabling the scan
+          keeps the SBOM, but disabling the SBOM also stops the scan,
+          which has nothing to read.
+        required: false
+        type: boolean
+        default: true
       grype_fail_on:
         description: 'Minimum severity that fails the Grype scan'
         required: false
@@ -908,6 +918,7 @@ jobs:
       # dependencies.
       - name: 'Grype audit SBOM'
         id: grype-audit
+        if: ${{ inputs.grype_enabled }}
         # yamllint disable-line rule:line-length
         uses: lfreleng-actions/grype-scan-action@87fd7bdad7f0809af58108e65f60debc244df348  # v0.0.2
         with:

.github/workflows/build-test-release-multiarch.yaml

@@ -172,8 +172,9 @@ on:
       # --- SBOM ---
       sbom_enabled:
         description: >-
-          Generate an SBOM (set false to skip; also skips the
-          dependent Grype scan job)
+          Generate an SBOM (set false to skip). The Grype scan
+          reads the SBOM, so skipping generation leaves it nothing to
+          scan. To keep the SBOM but drop the scan, use grype_enabled.
         required: false
         type: boolean
         default: true
@@ -189,6 +190,15 @@ on:
         default: 'both'
 
       # --- Grype scan ---
+      grype_enabled:
+        description: >-
+          Run the Grype vulnerability scan over the generated SBOM (set
+          false to skip). Decoupling is one-way: disabling the scan
+          keeps the SBOM, but disabling the SBOM also stops the scan,
+          which has nothing to read.
+        required: false
+        type: boolean
+        default: true
       grype_fail_on:
         description: 'Minimum severity that fails the Grype scan'
         required: false
@@ -721,7 +731,7 @@ jobs:
     # failure (which also skips Grype) gating the tests as before.
     needs: ['python-metadata', 'python-build', 'python-audit', 'sbom', 'grype']
     # yamllint disable-line rule:line-length
-    if: ${{ !cancelled() && needs.python-build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.python-audit.result) && contains(fromJSON('["success", "skipped"]'), needs.sbom.result) && contains(fromJSON('["success", "skipped"]'), needs.grype.result) && inputs.tests_enabled }}
+    if: ${{ !cancelled() && needs.python-build.result == 'success' && (needs.python-audit.result == 'success' || (needs.python-audit.result == 'skipped' && !inputs.audit_enabled)) && (needs.sbom.result == 'success' || (needs.sbom.result == 'skipped' && !inputs.sbom_enabled)) && (needs.grype.result == 'success' || (needs.grype.result == 'skipped' && (!inputs.grype_enabled || !inputs.sbom_enabled))) && inputs.tests_enabled }}
     strategy:
       fail-fast: false
       matrix:
@@ -1013,7 +1023,8 @@ jobs:
   grype:
     name: 'Grype ${{ matrix.target.arch }}'
     needs: 'sbom'
-    if: ${{ !cancelled() && needs.sbom.result == 'success' }}
+    # yamllint disable-line rule:line-length
+    if: ${{ !cancelled() && needs.sbom.result == 'success' && inputs.grype_enabled }}
     strategy:
       fail-fast: false
       matrix:
@@ -1093,7 +1104,7 @@ jobs:
     # never a failure (a failed test run, audit, SBOM or Grype scan
     # blocks the release here)
     # yamllint disable-line rule:line-length
-    if: ${{ !cancelled() && needs.python-build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.python-tests.result) && contains(fromJSON('["success", "skipped"]'), needs.python-audit.result) && contains(fromJSON('["success", "skipped"]'), needs.sbom.result) && contains(fromJSON('["success", "skipped"]'), needs.grype.result) }}
+    if: ${{ !cancelled() && needs.python-build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.python-tests.result) && (needs.python-audit.result == 'success' || (needs.python-audit.result == 'skipped' && !inputs.audit_enabled)) && (needs.sbom.result == 'success' || (needs.sbom.result == 'skipped' && !inputs.sbom_enabled)) && (needs.grype.result == 'success' || (needs.grype.result == 'skipped' && (!inputs.grype_enabled || !inputs.sbom_enabled))) }}
     permissions:
       contents: write  # IMPORTANT: needed to edit release, attach artefacts
     timeout-minutes: 5

.github/workflows/build-test-release.yaml

@@ -114,8 +114,9 @@ on:
       # --- SBOM ---
       sbom_enabled:
         description: >-
-          Generate an SBOM (set false to skip; also skips the
-          dependent Grype scan job)
+          Generate an SBOM (set false to skip). The Grype scan
+          reads the SBOM, so skipping generation leaves it nothing to
+          scan. To keep the SBOM but drop the scan, use grype_enabled.
         required: false
         type: boolean
         default: true
@@ -131,6 +132,15 @@ on:
         default: 'both'
 
       # --- Grype scan ---
+      grype_enabled:
+        description: >-
+          Run the Grype vulnerability scan over the generated SBOM (set
+          false to skip). Decoupling is one-way: disabling the scan
+          keeps the SBOM, but disabling the SBOM also stops the scan,
+          which has nothing to read.
+        required: false
+        type: boolean
+        default: true
       grype_fail_on:
         description: 'Minimum severity that fails the Grype scan'
         required: false
@@ -564,7 +574,7 @@ jobs:
       - 'sbom'
       - 'grype'
     # yamllint disable-line rule:line-length
-    if: ${{ !cancelled() && needs.python-build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.python-audit.result) && contains(fromJSON('["success", "skipped"]'), needs.sbom.result) && contains(fromJSON('["success", "skipped"]'), needs.grype.result) && inputs.tests_enabled }}
+    if: ${{ !cancelled() && needs.python-build.result == 'success' && (needs.python-audit.result == 'success' || (needs.python-audit.result == 'skipped' && !inputs.audit_enabled)) && (needs.sbom.result == 'success' || (needs.sbom.result == 'skipped' && !inputs.sbom_enabled)) && (needs.grype.result == 'success' || (needs.grype.result == 'skipped' && (!inputs.grype_enabled || !inputs.sbom_enabled))) && inputs.tests_enabled }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.python-build.outputs.matrix_json) }}
@@ -775,7 +785,8 @@ jobs:
     name: 'Grype Audit SBOM'
     runs-on: ubuntu-latest
     needs: 'sbom'
-    if: ${{ !cancelled() && needs.sbom.result == 'success' }}
+    # yamllint disable-line rule:line-length
+    if: ${{ !cancelled() && needs.sbom.result == 'success' && inputs.grype_enabled }}
     timeout-minutes: ${{ inputs.audit_timeout_minutes }}
     permissions:
       contents: read
@@ -840,7 +851,7 @@ jobs:
     # never a failure (a failed test run, audit, SBOM or Grype scan
     # blocks the release here)
     # yamllint disable-line rule:line-length
-    if: ${{ !cancelled() && needs.python-build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.python-tests.result) && contains(fromJSON('["success", "skipped"]'), needs.python-audit.result) && contains(fromJSON('["success", "skipped"]'), needs.sbom.result) && contains(fromJSON('["success", "skipped"]'), needs.grype.result) }}
+    if: ${{ !cancelled() && needs.python-build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.python-tests.result) && (needs.python-audit.result == 'success' || (needs.python-audit.result == 'skipped' && !inputs.audit_enabled)) && (needs.sbom.result == 'success' || (needs.sbom.result == 'skipped' && !inputs.sbom_enabled)) && (needs.grype.result == 'success' || (needs.grype.result == 'skipped' && (!inputs.grype_enabled || !inputs.sbom_enabled))) }}
     permissions:
       contents: write  # IMPORTANT: needed to edit release, attach artefacts
     timeout-minutes: 5

.github/workflows/build-test.yaml

@@ -111,8 +111,9 @@ on:
       # --- SBOM ---
       sbom_enabled:
         description: >-
-          Generate an SBOM (set false to skip; also skips the
-          dependent Grype scan job)
+          Generate an SBOM (set false to skip). The Grype scan
+          reads the SBOM, so skipping generation leaves it nothing to
+          scan. To keep the SBOM but drop the scan, use grype_enabled.
         required: false
         type: boolean
         default: true
@@ -128,6 +129,15 @@ on:
         default: 'both'
 
       # --- Grype scan ---
+      grype_enabled:
+        description: >-
+          Run the Grype vulnerability scan over the generated SBOM (set
+          false to skip). Decoupling is one-way: disabling the scan
+          keeps the SBOM, but disabling the SBOM also stops the scan,
+          which has nothing to read.
+        required: false
+        type: boolean
+        default: true
       grype_fail_on:
         description: 'Minimum severity that fails the Grype scan'
         required: false
@@ -654,7 +664,8 @@ jobs:
     name: 'Grype Audit SBOM'
     runs-on: ubuntu-latest
     needs: 'sbom'
-    if: ${{ !cancelled() && needs.sbom.result == 'success' }}
+    # yamllint disable-line rule:line-length
+    if: ${{ !cancelled() && needs.sbom.result == 'success' && inputs.grype_enabled }}
     timeout-minutes: ${{ inputs.audit_timeout_minutes }}
     permissions:
       contents: read

examples/build-test-multiarch/github.yaml

@@ -56,6 +56,8 @@ jobs:
     #   test_permit_fail: false       # soft-fail tests
     #   audit_permit_fail: false      # soft-fail dependency audit
     #   sbom_include_dev: false       # include dev deps in the SBOM
+    #   sbom_enabled: true            # false skips SBOM generation
+    #   grype_enabled: true           # false skips the Grype scan only
     #   grype_fail_on: 'medium'       # Grype severity gate
     #   harden_runner_egress: 'block' # 'block' (default) or 'audit'
     #   # --- Multi-arch inputs ---

examples/build-test/github.yaml

@@ -52,5 +52,7 @@ jobs:
     #   test_permit_fail: false       # soft-fail tests
     #   audit_permit_fail: false      # soft-fail dependency audit
     #   sbom_include_dev: false       # include dev deps in the SBOM
+    #   sbom_enabled: true            # false skips SBOM generation
+    #   grype_enabled: true           # false skips the Grype scan only
     #   grype_fail_on: 'medium'       # Grype severity gate
     #   harden_runner_egress: 'block' # 'block' (default) or 'audit'