v6.0.0

New in scan-action v6.0.0

Breaking Change

• feat: add output-file option, default to random directory output in temp (#346) [kzantow]

The action no longer generates files in your working directory by default, instead you should use the action outputs: ${{ steps.<id>.outputs.sarif }} where the <id> needs to match the id you configured to reference the scan-action, e.g.:

      - uses: anchore/scan-action@v6
        id: scan
        ...
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

Other Changes

• chore(deps): update Grype to v0.86.1 (#416) [anchore-actions-token-generator]
• feat: add support for cyclonedx and cyclonedx-json output-formats (#396) [ps-e]
• chore(deps): bump @actions/cache from 3.3.0 to 4.0.0 (#412) [dependabot]
• chore(deps): update Grype to v0.86.0 (#413) [anchore-actions-token-generator]

v5.3.0

New in scan-action v5.3.0

• chore(deps): update Grype to v0.85.0 (#408) [anchore-actions-token-generator]
• chore(deps-dev): bump @vercel/ncc from 0.38.2 to 0.38.3 (#406) [dependabot]
• chore(deps-dev): bump eslint from 9.14.0 to 9.15.0 (#405) [dependabot]
• chore(deps-dev): bump husky from 9.1.6 to 9.1.7 (#407) [dependabot]

v5.2.1

New in scan-action v5.2.1

• update Grype to v0.84.0 (#404) [anchore-actions-token-generator]
• bump @actions/cache from 3.2.4 to 3.3.0 (#402) [dependabot]

v5.2.0

New in scan-action v5.2.0

• chore(deps): update Grype to v0.83.0 (#398) [anchore-actions-token-generator]
• chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#394) [dependabot]
• chore(deps): bump actions/setup-node from 4.0.4 to 4.1.0 (#395) [dependabot]

v5.1.0

New in scan-action v5.1.0

• chore(deps): update Grype to v0.82.2 (#393) [anchore-actions-token-generator]
• chore(deps-dev): bump eslint from 9.12.0 to 9.13.0 (#392) [dependabot]
• chore(deps-dev): bump tslib from 2.7.0 to 2.8.0 (#391) [dependabot]

v5.0.1

New in scan-action v5.0.1

• chore(deps): update Grype to v0.82.1 (#389) [anchore-actions-token-generator]

v5.0.0

New in scan-action v5.0.0

• chore(deps): update Grype to v0.82.0 (#383) [anchore-actions-token-generator]

🚀 Features

• feat: short-lived grype-db cache (#348) [kzantow]
  Note: with this release grype is no longer installed on $PATH. We suspect the changes here could break a number of users of the action who have learned to expect Grype be installed on $PATH.

v4.1.2

New in scan-action v4.1.2

• Update Grype to v0.80.0 (#358) [anchore-actions-token-generator]

v4.1.1

New in scan-action v4.1.1

• chore(deps): update Grype to v0.79.6 (#352) [anchore-actions-token-generator]
• Document grype-version parameter (#319) [vprivat-ads]

v4.1.0

New in scan-action v4.1.0

• chore(deps): update Grype to v0.79.3 (#341) [anchore-actions-token-generator]