[mikecook]

Summary

Fetch grype's install.sh from the grype version tag in .settings.yaml instead of main, so the pinned checksum stays valid until the grype version is bumped.

Motivation / Context

tools/setup-tools downloaded install.sh from anchore/grype/main and verified it against a fixed GRYPE_INSTALL_SHA256. Upstream merged a refactor of the script's argument handling, which changed its hash and broke the install step with a checksum mismatch. The tagged file is immutable, and install.sh at v0.119.0 hashes to the existing pin, so no hash change is needed.

Fixes: N/A
Related: N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: tools/setup-tools

Implementation Notes

• GRYPE_SCRIPT_URL now uses ${GRYPE_VERSION} instead of main.
• Added a comment above GRYPE_INSTALL_SHA256 with the command to re-pin it when security_tools.grype is bumped, matching the existing golangci-lint pin.
• Renovate bumps security_tools.grype but does not update the hash, so a grype bump will fail the check until the hash is re-pinned. golangci-lint already behaves this way.
• The grype/main line in tools/registry-inventory/shell_test.go is a parser fixture and is intentionally unchanged.

Testing

# Commands run (prefer `make qualify` for non-trivial changes)
bash -n tools/setup-tools
bash tools/setup-tools_test.sh
go test ./tools/registry-inventory/...
curl -fsSL https://raw.githubusercontent.com/anchore/grype/v0.119.0/install.sh | shasum -a 256

bash -n, tools/setup-tools_test.sh, and the registry-inventory tests pass. The tagged install.sh hashes to 8646f06a90b10ca64992c1809b4aa00c44e30b4f551f63c309b0b0ab66873556, which matches GRYPE_INSTALL_SHA256. The previous main file hashed to the same value before the upstream change and now hashes to af43b85a127bb0462f248f70f801d62e82ae584fcd05365853c709bd2cfc3b5c.

Risk Assessment

• Low — Isolated change, well-tested, easy to revert
• Medium — Touches multiple components or has broader impact
• High — Breaking change, affects critical paths, or complex rollout

Rollout notes: N/A. Only the Linux grype install path changes, and the verified hash is unchanged.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S) — GPG signing info

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/aicr/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 77f8609f-5f6b-41c6-9b87-09764a47ec97

📥 Commits

Reviewing files that changed from the base of the PR and between d0c6691 and bb37dd3.

📒 Files selected for processing (1)

• tools/setup-tools

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The Grype installer now fetches install.sh from the tag set by GRYPE_VERSION, instead of from the moving main branch. Comments state that the script’s SHA-256 pin is version-specific and document the command used to calculate it.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: mchmarny

Merge Risk: ⚪ Minimal · up to bb37d

No actionable merge-blocking risk remains; the installer pin is verified for the configured version.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: fetching Grype's install script from the pinned version tag instead of the moving main branch.
Description check	✅ Passed	The description is directly related to the changeset. It explains the checksum mismatch, the pinned-tag fix, implementation details, testing, and risk.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}