Grype for MSP CI — SBOM → fail-closed vulnerability gate

Scan images, filesystems and SBOMs — then fail the pipeline on known vulns

anchore/grype (~12,911★ as of HTML snapshot 2026-09-21; last commit 2026-09-18T15:59:50Z) vulnerability-scans container images, filesystems and SBOMs. MSPs can wire Grype as a fail-closed CI gate after SBOM generation so known CVEs block merge until exceptions are owned.

Do not restamp Syft or Trivy coverage from earlier packs — this draft is Grype-as-gate only. No invented adoption metrics beyond the cited star/commit snapshot.

MSP CI pattern: generate an SBOM in the pipeline, run Grype against that SBOM (and optionally the image), set a severity threshold that fails the job, and require a named exception with expiry for anything that must merge dirty. Pair thematically with dependency-update bots — but keep this pack focused on the scan gate, not Renovate restamps.

Grype does not replace patch ownership, least privilege or runtime controls. Validate thresholds in a non-prod pipeline first.

# MSP Grype CI checklist — defensive / fail-closed
1. Generate SBOM in CI for images and relevant filesystems
2. Run Grype against the SBOM (and optionally the image)
3. Fail the job above an owned severity threshold
4. Require named exceptions with expiry for dirty merges
5. Do not restamp Syft/Trivy in this pack — Grype-as-gate only
6. Cite only the GitHub star/commit snapshot; no invented adoption metrics