Anchore Grype SBOM and Container Vulnerability Sentinel

id: anchore-grype-vulnerability-scanner-sentinel
namespace: company.security

inputs:
  - id: target_image
    type: STRING
    description: "Container image or SBOM file to scan with Grype (e.g. alpine:3.18,
      app:latest)."

tasks:
  - id: run_grype_audit
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: anchore/grype:latest
    commands:
      - |
        # Run Grype scanning for critical vulnerabilities with available fixes
        grype "{{ inputs.target_image }}" --only-fixed --severity critical -o json > /tmp/grype_telemetry.json

        CRITICAL_FIXED=$(jq '.matches | length // 0' /tmp/grype_telemetry.json)
        echo "::set-output name=critical_count::$CRITICAL_FIXED::"

  - id: evaluate_grype_vulnerabilities
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.run_grype_audit.vars.critical_count | int > 0 }}"
    then:
      - id: notify_security_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#security-ops",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Anchore Grype Critical CVEs Found Alert",
                "text": "Target `{{ inputs.target_image }}` contains *{{ outputs.run_grype_audit.vars.critical_count }} patchable CRITICAL vulnerabilities*! Fix versions are available and should be updated immediately.",
                "footer": "Kestra Security Sentinel • Anchore Grype"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#security-ops",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Grype Sentinel Failure",
            "text": "Failed to complete Grype vulnerability scan. Verify image registry reachability.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 5 * * *"
    disabled: true