add grype ignore

Author: anthony-nhs

.github/workflows/build_multi_arch_image.yml

@@ -111,17 +111,6 @@ jobs:
           CONTAINER_NAME: '${{ inputs.container_name }}'
           BASE_FOLDER: "${{ inputs.base_folder }}"
           IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
-      - name: Show docker vulnerability output
-        if: always()
-        run: |
-          echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
-          if [ -f ".grype_out/grype_${CONTAINER_NAME}_${IMAGE_TAG}.txt" ]; then
-            cat ".grype_out/grype_${CONTAINER_NAME}_${IMAGE_TAG}.txt"
-          fi
-        env:
-          CONTAINER_NAME: '${{ inputs.container_name }}'
-          ARCHITECTURE: '${{ matrix.arch }}'
-          DOCKER_TAG: '${{ inputs.docker_tag }}'
       - name: Push tagged image and rebuild for github actions
         run: |
           echo "Pushing image..."

.grype.yaml

@@ -0,0 +1,29 @@
+ignore:
+  # Ignore specific CVEs
+  - vulnerability: CVE-2025-4517
+  - vulnerability: CVE-2025-68121
+  - vulnerability: GHSA-p77j-4mvh-x3m3
+  - vulnerability: GHSA-vmwr-mc7x-5vc3
+  - vulnerability: CVE-2025-4330
+  - vulnerability: CVE-2025-4435
+  - vulnerability: CVE-2025-4138
+  - vulnerability: CVE-2025-8194
+  - vulnerability: CVE-2025-13836
+  - vulnerability: CVE-2024-9287
+  - vulnerability: CVE-2025-61726
+  - vulnerability: CVE-2026-4519
+  - vulnerability: CVE-2026-25679
+  - vulnerability: CVE-2025-61725
+  - vulnerability: CVE-2025-61723
+  - vulnerability: CVE-2025-61729
+  - vulnerability: GHSA-4vrq-3vrq-g6gg
+  - vulnerability: CVE-2025-58187
+  - vulnerability: CVE-2026-27137
+  - vulnerability: CVE-2025-47907
+  - vulnerability: CVE-2025-61731 
+  - vulnerability: GHSA-9h8m-3fm2-qjrq
+  - vulnerability: CVE-2025-61732
+  - vulnerability: GHSA-4c29-8rgm-jvjj
+  - vulnerability: CVE-2025-58188
+  - vulnerability: CVE-2025-4674
+  - vulnerability: GHSA-x744-4wpc-v9h2

Makefile

@@ -94,12 +94,11 @@ build-githubactions-image: guard-BASE_IMAGE_NAME guard-BASE_IMAGE_TAG guard-IMAG
 		--load \
 		-t "${CONTAINER_PREFIX}$${BASE_IMAGE_NAME}:githubactions-$${IMAGE_TAG}" \
 		.
-
 scan-image: guard-CONTAINER_NAME guard-BASE_FOLDER guard-IMAGE_TAG
 	grype "${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}" \
 		--scope all-layers \
 		--sort-by severity \
-		--file ".grype_out/grype_${CONTAINER_NAME}_${IMAGE_TAG}.txt"
+		--fail-on high
 
 scan-image-json: guard-CONTAINER_NAME guard-BASE_FOLDER guard-IMAGE_TAG
 	grype "${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}" \