feat(image): add syft and grype tooling

Add syft and grype as pinned image tools, wire Renovate version tracking,
and document both CLIs in the runner tool list.

Made-with: Cursor

Author: miragecentury

CHANGELOG.md

@@ -17,6 +17,7 @@
 ### Added
 
 * **runner:** export `${APP_HOME}/.local/bin` at image level so Poetry and UV are discoverable in both `sh` and `bash` execution contexts
+* **tools:** add `syft` and `grype` to the image with pinned versions, Renovate tracking, and documentation updates
 
 ### Changed
 

Containerfile

@@ -46,6 +46,24 @@ RUN curl -fsSL https://aquasecurity.github.io/trivy-repo/deb/public.key \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
+# Install syft (SBOM generator)
+ARG SYFT_VERSION=1.43.0
+RUN curl -sSL -o /tmp/syft.tgz \
+      "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.tar.gz" \
+    && tar -xzf /tmp/syft.tgz -C /tmp syft \
+    && mv /tmp/syft /usr/local/bin/syft \
+    && chmod +x /usr/local/bin/syft \
+    && rm -f /tmp/syft.tgz
+
+# Install grype (vulnerability scanner)
+ARG GRYPE_VERSION=0.111.1
+RUN curl -sSL -o /tmp/grype.tgz \
+      "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_amd64.tar.gz" \
+    && tar -xzf /tmp/grype.tgz -C /tmp grype \
+    && mv /tmp/grype /usr/local/bin/grype \
+    && chmod +x /usr/local/bin/grype \
+    && rm -f /tmp/grype.tgz
+
 # Install dive (container filesystem analysis)
 ARG DIVE_VERSION=0.13.1
 # hadolint ignore=DL3008

README.md

@@ -34,6 +34,8 @@ These tools allow the image to run its own build pipeline as a self-hosted runne
 | [buildah](https://github.com/containers/buildah) | OCI container image builder |
 | [dive](https://github.com/wagoodman/dive) | Container filesystem analysis |
 | [trivy](https://github.com/aquasecurity/trivy) | Vulnerability scanner |
+| [syft](https://github.com/anchore/syft) | Software bill of materials (SBOM) generator |
+| [grype](https://github.com/anchore/grype) | Container and SBOM vulnerability scanner |
 | [hadolint](https://github.com/hadolint/hadolint) | Dockerfile/Containerfile linter |
 | [yq](https://github.com/mikefarah/yq) | YAML processor |
 | [pre-commit](https://pre-commit.com/) | Git hooks framework |
@@ -106,6 +108,8 @@ build:
     - KARGO_VERSION=1.9.6
     - PACK_VERSION=0.40.2
     - DIVE_VERSION=0.13.1
+    - SYFT_VERSION=1.43.0
+    - GRYPE_VERSION=0.111.1
     - HADOLINT_VERSION=2.14.0
     - YQ_VERSION=4.53.2
   labels:

manifest.yaml

@@ -10,6 +10,8 @@ build:
     - KARGO_VERSION=1.9.6
     - PACK_VERSION=0.40.2
     - DIVE_VERSION=0.13.1
+    - SYFT_VERSION=1.43.0
+    - GRYPE_VERSION=0.111.1
     - HADOLINT_VERSION=2.14.0
     - YQ_VERSION=4.53.2
   labels:

renovate.json

@@ -22,6 +22,24 @@
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^v?(?<version>.+)$"
     },
+    {
+      "customType": "regex",
+      "description": "Update Syft version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["SYFT_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "anchore/syft",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "description": "Update Grype version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["GRYPE_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "anchore/grype",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    },
     {
       "customType": "regex",
       "description": "Update Hadolint version",