Scan a container image or SBOM with Grype and configure fail thresholds based on severity to gate a CI pipeline

Steps

1. Run grype <image-or-sbom-path> --output json > grype-results.json to scan and capture structured output; use an SBOM file as input (grype sbom:./sbom.cdx.json) to decouple scanning from image pulling.
2. Add a --fail-on <severity> flag (e.g., --fail-on high) to make Grype exit with a non-zero code when vulnerabilities at or above the threshold are found; verify the exact flag name in current Grype docs.
3. Create a .grype.yaml configuration file to specify ignore rules for CVEs that are not applicable (e.g., vulnerabilities in test dependencies or fixed-by-vendor status), reducing noise in the fail threshold.
4. Parse the JSON output in a post-scan step to produce a human-readable summary or comment on a pull request with the count and severity breakdown.
5. Pin the Grype vulnerability database update separately from the scan step to ensure reproducible scan results within a pipeline run.