fix(ci): point Grype at shared RO node cache instead of copying - #39
Merged
Conversation
Stop copying the DB into $RUNNER_TEMP / $HOME/.cache. Point GRYPE_DB_CACHE_DIR at the RO /var/cache/grype-db mount with auto-update off so mandatory-only and dependency-scan no longer ENOSPC or waste ~2GiB RAM per job. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates CI vulnerability scanning to avoid copying the Grype database into runner-local caches by directly using a shared (read-only) Grype DB mount, aiming to eliminate ENOSPC failures on limited tmpfs-backed cache locations.
Changes:
- Removes the “seed Grype DB from node cache” copy steps from
mandatory-onlyanddependency-scan. - Sets
GRYPE_DB_CACHE_DIR=/var/cache/grype-dband disables auto-updates viaGRYPE_DB_AUTO_UPDATE=falsefor Grype runs. - Documents the CI change in the Unreleased changelog.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| CHANGELOG.md | Notes the CI Grype DB behavior change and motivation (avoid ENOSPC / wasted RAM). |
| .github/workflows/ci.yml | Stops copying the Grype DB into $HOME and points Grype to the shared node cache mount with auto-update disabled. |
Suppressed comments (1)
.github/workflows/ci.yml:149
- This step assumes the shared Grype DB mount is always present and disables auto-update. If the cache is missing/cold (or the mount isn’t available on some runners), Grype will error out rather than downloading a DB. Consider gating the shared-cache settings on
/var/cache/grype-db/6existing and falling back to a writable cache under$RUNNER_TEMPwith auto-update enabled.
env:
REPO_NAME: ${{ github.event.repository.name }}
# Shared RO Grype DB on the runner mount (no copy into 2Gi tmpfs).
GRYPE_DB_CACHE_DIR: /var/cache/grype-db
GRYPE_DB_AUTO_UPDATE: "false"
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
72
to
+76
| env: | ||
| REPO_NAME: ${{ github.event.repository.name }} | ||
| # Shared RO Grype DB on the runner mount (no copy into 2Gi tmpfs). | ||
| GRYPE_DB_CACHE_DIR: /var/cache/grype-db | ||
| GRYPE_DB_AUTO_UPDATE: "false" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mandatory-onlyanddependency-scan.GRYPE_DB_CACHE_DIRat/var/cache/grype-dbwithGRYPE_DB_AUTO_UPDATE=false.Depends on Laelidona/velmios-infrastructure#15 for a valid shared DB + expanded PVC.
Test plan
mandatory-onlyanddependency-scancomplete without ENOSPC after infra mergeMade with Cursor