anchore / anchore/scan-action

Read Connection Timeout - Downloading Grype DB

Open
#306 10 comments 2 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
287
Forks
95
Avg merge
13h 23m
Merged PRs (30d)
13

Description

# Issue
Recently in our CI, we have been experiencing grype db tcp read timeouts while downloading the db as part of using the action. This is leading to delayed and failed CVE scanning / additional time for the build pipelines to complete.

Screenshot 2024-04-23 at 2 07 58 PM

# Version
Grype version: `v0.74.4`
Action Version: `anchore/scan-action@v3.6.4`

# Observation
- This seems to be intermittent but more frequently lately (~2 weeks) and doesn't seem to be specific the above versions.

# Expectation
1. What is the default behavior when the `GRYPE_DB_AUTO_UPDATE: false` is set ? Does the action fail or run on first and subsequent invocations assuming no other DB is imported manually? (Eg: When invoked multiple times within the same pipeline job?) - Testing it seems it did fail (Refer screenshots in below comment)
2. Can the action be enhanced to always check DB status and only download latest DB even for a specific case where `GRYPE_DB_AUTO_UPDATE: false && DB_STATUS=invalid` for first invocation of action within a single job?
3. Are there any other recommendations to avoid the timeout issue / delayed scanning time? (Eg: How to increase / override the `db.update-download-timeout` parameter in [config](https://github.com/anchore/grype?tab=readme-ov-file#configuration) across multiple repos using a shared workflow of this action?)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how the action handles GRYPE_DB_AUTO_UPDATE and the Grype database update configuration, especially db.update-download-timeout. Reproduce the first and subsequent invocations described in the issue using Grype v0.74.4 and anchore/scan-action@v3.6.4. Done means the timeout behavior and invalid-database case are understood and a supported configuration or action change is identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
ci-cd, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.