Grype integration

Synchronize Seal's remediation findings into Grype via .grype.yaml policy-file edits. Local fix mode only.

Grype is the Anchore vulnerability scanner. It does not expose a hosted API to write findings into; instead, it reads a .grype.yaml policy file at scan time. The Seal CLI writes ignore entries to that file for the vulnerabilities Seal has sealed, and Grype suppresses them on the next scan.

The Grype integration is meaningful only in Local fix mode, where the Seal CLI already writes into the repository checkout (.seal-actions.yml). In Remote or all mode the CLI does not modify your repository, so there is no natural place to land the policy-file edit.

Before you start

The Seal CLI step that drives the integration must have write access to the repository checkout in CI.

Enabling policy-file generation

There are two ways to enable Grype policy-file generation:

• Through the UI. Under Settings > Preferences, enable the Grype policy file update toggle. With this on, every automatic PR that updates .seal-actions.yml also writes the matching .grype.yaml entries.

• From the CLI. Invoke the Seal CLI with the explicit flags:

seal scan --generate-actions-file --generate-grype-policy

The CLI generates or updates .grype.yaml at the project root with ignore entries for each vulnerability Seal sealed in this run.

The same Settings > Preferences pane carries the matching toggle for Snyk policy-file updates.

Committing the file

.grype.yaml is part of your repository. Commit it like any other source-controlled config. Grype reads the version of the file present in the branch being scanned.

Ecosystem coverage

The Grype integration maps Seal-sealed packages onto Grype's package-type identifiers. The mapping covers npm, pip, Go modules, Maven, and NuGet. Packages from ecosystems outside that set are not added to .grype.yaml; Grype's other coverage is unaffected, but Seal does not write entries for those packages.

Verify

After a seal fix run with the integration configured, inspect the generated .grype.yaml. It should contain an ignore: block with one entry per vulnerability Seal sealed, identifying the vulnerability, the package, and the version. Re-running Grype against the checkout should no longer report those vulnerabilities.

Related

• How CLI-driven sync works

• Snyk integration: the other policy-file-edit path, sharing the same UI toggle pattern.

• External scanner support: for Grype scans that run outside your organization, where you cannot write a policy file into the scanned checkout.