fix(security): scan containers once per image, cache Grype DB - #54
Open
thossain-nv wants to merge 1 commit into
Open
fix(security): scan containers once per image, cache Grype DB#54thossain-nv wants to merge 1 commit into
thossain-nv wants to merge 1 commit into
Conversation
thossain-nv
requested review from
abegnoche,
huaweic-nv,
lachen-nv and
mmou-nv
as code owners
August 7, 2026 19:01
|
All contributors have signed the DCO ✍️ ✅ |
Author
|
I have read the DCO Document and I hereby sign the DCO |
3 tasks
thossain-nv
added a commit
to NVIDIA/infra-controller
that referenced
this pull request
Aug 8, 2026
…x grype (#4693) Rust hit rates on main sit between 0% and 30% because of two problems: sccache silently stops writing partway through a run, and pull requests fill the 50 GB pool with copies nothing else can read. - sccache recovers from a rate-limited startup check (sccache-cache.sh): `RemoteStorage::check` performs a single write when the server starts and, on any error including a transient rate limit, wraps the storage read-only for the life of the process. This PR allows retry - sccache-test tarball only saves on main (ci.yaml): The restore-keys prefix means any pull request whose `Cargo.lock` differs from main's takes a prefix match, so `cache-hit` is false and the save fires — three ref-scoped 5 GB copies were live at once - mkosi package cache only saves on main (build-boot-artifacts.yml): Fixes similar duplicate cache: nine copies of a 1.3 GB entry, 10.7 GB - grype is taking 24m on main runs because it's DB caching is broken and it repeats run per format. Action fix here: NVIDIA/dsx-github-actions#54 ## Related Issues #4574 ## Type of Change - [x] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Breaking Changes - [ ] **This PR contains breaking changes** ## Testing - [x] No testing required (docs, internal refactor, etc.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Grype runs three times per image (once per output format), and each run re-downloaded the 1.9 GB vulnerability DB because the cache mount was dead: the scanner image sets no
HOME, so Grype resolves its cache to/.cache/grype/db, never the mounted/root/.cache/grype.This PR ensures:
json,sarif,tableGRYPE_DB_CACHE_DIRso the existing mount is usedOn
alpine:3.20: 46s cold, 3s, warm. Currentmainrun twice: 31s, 31s, cache dir still empty. Inputs, outputs and--fail-onsemantics unchanged.Checklist