fix: add only-fixed flag to Grype scans to skip unfixable CVEs

Co-Authored-By: Paperclip <noreply@paperclip.ing>
fix: remediate high-severity CVEs in Docker images (#204 )
2026-04-15 00:28:56 +00:00 · 2026-04-14 23:57:40 +00:00
1 changed files with 4 additions and 0 deletions
@@ -170,6 +170,7 @@ jobs:
          image: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}"
          fail-build: true
          severity-cutoff: high
+          only-fixed: "true"
          output-format: sarif

      - name: Upload frontend scan results to GitHub Security
@@ -266,6 +267,7 @@ jobs:
          image: "${{ env.REGISTRY }}/${{ env.AUTH_IMAGE_NAME }}:sha-${{ github.sha }}"
          fail-build: true
          severity-cutoff: high
+          only-fixed: "true"
          output-format: sarif

      - name: Upload auth scan results to GitHub Security
@@ -351,6 +353,7 @@ jobs:
          image: "${{ env.REGISTRY }}/${{ env.RECEIPTWITNESS_IMAGE_NAME }}:sha-${{ github.sha }}"
          fail-build: true
          severity-cutoff: high
+          only-fixed: "true"
          output-format: sarif

      - name: Upload receiptwitness scan results to GitHub Security
@@ -436,6 +439,7 @@ jobs:
          image: "${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}:sha-${{ github.sha }}"
          fail-build: true
          severity-cutoff: high
+          only-fixed: "true"
          output-format: sarif

      - name: Upload api scan results to GitHub Security
Author	SHA1	Message	Date
Hugh Hackman	bd2e8feff6	fix: add only-fixed flag to Grype scans to skip unfixable CVEs Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-15 00:28:56 +00:00
cartsnitch-cto[bot]	1e8223caeb	fix: remediate high-severity CVEs in Docker images (#204 ) fix: remediate high-severity CVEs in Docker images	2026-04-14 23:57:40 +00:00