fix empty cve results due to grype db cache staleness

[saisatishkarra]

Summary

This should fix the issue where the scan job doesn't report any vulnerabilities due to caching issues of grype db which results in staleness.

Checklist

• The Pull Request has tests
• A changelog file has been created under changelog/unreleased/kong or skip-changelog label added on PR if changelog is unnecessary. README.md
• There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE

Issue reference

Fix #[issue number]

[saisatishkarra]

@windmgc / @curiositycasualty / @Water-Melon / @AndyZhang0707

Github doesn't provide a way to save / overwrite same cache key. Hence this unique short-term cache keys are used for this approach. Refer Kong/public-shared-actions#147 for errors encountered trying to update same cache key when multiple workflows / jobs are trying to access it.

This approach generates grype db cache (~ 150mb) using cache_grype_<github.run_id>-<github..run_attempt> which can result in a lot of short term unique caches and quickly hit cache limit of 10GB. Github however rotates unused cache in 7 days. If GH cache is being exhausted; consider using GH extension to delete cache on PR closed

LMK if this works / can be tuned here.

As an alternative, I can add an input parameter to skip caching grype db completely and rely on making the network calls to external CDN. Grype updated their CDN as per this post and the shared action can be updated to skip caching when explicitly set for GW to entirely rely on Grype new CDN

FYI: @pankajmouriyakong / @amankong

[team-gateway-bot]

Successfully created backport PR for release/3.8.x:

• [backport -> release/3.8.x] fix empty cve results due to grype db cache staleness #13548

[team-gateway-bot]

Cherry-pick failed for master, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally.

git remote add upstream https://github.com/kong/kong-ee
git fetch upstream master
git worktree add -d .worktree/cherry-pick-13544-to-master-to-upstream upstream/master
cd .worktree/cherry-pick-13544-to-master-to-upstream
git checkout -b cherry-pick-13544-to-master-to-upstream
ancref=$(git merge-base 61e82aaaf10a1bf7a221811953c53d1530e3d1a3 42548e0fa65a2c8af8a00775fc091ef42c539c8c)
git cherry-pick -x $ancref..42548e0fa65a2c8af8a00775fc091ef42c539c8c

[team-gateway-bot]

Backport failed for release/3.8.x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release/3.8.x
git worktree add -d .worktree/backport-13544-to-release/3.8.x origin/release/3.8.x
cd .worktree/backport-13544-to-release/3.8.x
git switch --create backport-13544-to-release/3.8.x
git cherry-pick -x dfc6029b2adabae38fbad57cbd8eb1a4f065bd3e