id       = "grype"
name     = "Grype"
homepage = "https://github.com/anchore/grype"
description = "A vulnerability scanner for container images and filesystems."
executables   = ["grype"]

[dotfiles]

# https://oss.anchore.com/docs/reference/grype/configuration/ — Grype searches
# ~/.grype.yaml and $XDG_CONFIG_HOME/grype/config.yaml after project-local
# files. The default XDG path is represented explicitly for portable fixtures.
paths = [
  "~/.grype.yaml",
  "~/.config/grype/config.yaml",
]
secret = []
side_effect = false

[commands]
format = 1
label = "Scan for vulnerabilities"
description = "Scan a container image, directory or SBOM with Grype. Only the flags quoted in Grype's own source are offered; ignore rules, DB and VEX options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "src"
kind = "help"
url = "https://github.com/anchore/grype/blob/main/cmd/grype/cli/options/grype.go"
revision = "main 2026-10-27"
evidence = '''
Use:   fmt.Sprintf("%s [IMAGE]", app.ID().Name),
Short: "A vulnerability scanner for container images, filesystems, and SBOMs",
Outputs []string // -o, <presenter>=<file> the Presenter hint string to use for report formatting and the output file
File string // --file, the file to write report output to
Distro string // --distro, specify a distro to explicitly use
Platform string // --platform, override the target platform for a container image
ByCVE bool // --by-cve, indicates if the original match vulnerability IDs should be preserved or the CVE should be used instead
bad --fail-on severity value
same as --name; set the name of the target being analyzed
same as --exclude
the output format of the vulnerability report (options: table, template, json, cyclonedx)
upon scanning, if a severity is found at or above the given severity then the return code will be 1
default is unset which will skip this validation (options: negligible, low, medium, high, critical)
grype --from containers-storage localhost/myimage:latest
'''

[[commands.field]]
id = "target"
label = "Image, directory or SBOM"
description = "For example alpine:latest, ./my-project or sbom:./sbom.json. Leave empty to read an SBOM from standard input."
type = "string"
position = 0
sources = ["src"]

[[commands.field]]
id = "output"
label = "Output format"
type = "string"
option = ["-o"]
suggestions = [{ value = "table", label = "Table" }, { value = "json", label = "JSON" }, { value = "cyclonedx", label = "CycloneDX" }, { value = "template", label = "Go template" }]
sources = ["src"]

[[commands.field]]
id = "file"
label = "Write report to file"
type = "path"
option = ["--file"]
path = { kind = "file", role = "output", must_exist = false }
effect = "overwrite"
sources = ["src"]

[[commands.field]]
id = "fail_on"
label = "Fail on severity"
description = "Exit non-zero when a vulnerability at or above this severity is found."
type = "enum"
option = ["--fail-on"]
choices = [{ value = "negligible", label = "Negligible" }, { value = "low", label = "Low" }, { value = "medium", label = "Medium" }, { value = "high", label = "High" }, { value = "critical", label = "Critical" }]
sources = ["src"]

[[commands.field]]
id = "from"
label = "Source type"
description = "Force how the target is read, for example docker, registry, podman or containers-storage."
type = "string"
option = ["--from"]
suggestions = [{ value = "docker", label = "Docker" }, { value = "registry", label = "Registry" }, { value = "podman", label = "Podman" }, { value = "containers-storage", label = "containers-storage" }]
sources = ["src"]

[[commands.field]]
id = "platform"
label = "Platform"
description = "For example linux/arm64."
type = "string"
option = ["--platform"]
sources = ["src"]

[[commands.field]]
id = "distro"
label = "Distro to match"
type = "string"
option = ["--distro"]
sources = ["src"]

[[commands.field]]
id = "exclude"
label = "Exclude paths (glob)"
type = "string"
option = ["--exclude"]
multiple = true
sources = ["src"]

[[commands.field]]
id = "by_cve"
label = "Orient results by CVE"
type = "boolean"
option = ["--by-cve"]
sources = ["src"]

[[commands.field]]
id = "name"
label = "Target name"
type = "string"
option = ["--name"]
sources = ["src"]

[[commands.task]]
id = "scan"
label = "Scan a target"
fields = ["target", "output", "fail_on"]
required = ["target"]

[[commands.task]]
id = "ci-gate"
label = "Fail the build on high severity"
set = { fail_on = ["high"] }
fields = ["target", "fail_on", "output", "file"]
required = ["target"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["target", "output", "file", "fail_on"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["from", "platform", "distro", "exclude", "by_cve", "name"]