[Feature Request] Add Support for Anchore Grype as a Vulnerability Scanner Alternative

[yu-iskw]

Summary

In light of the recent security incident involving the Trivy supply chain (GHSA-69fq-xp46-6x23), it is increasingly important for security-conscious users to have alternatives for vulnerability scanning.

We propose adding official support for Grype by Anchore to the Trunk ecosystem. Grype is a powerful, fast, and widely-used vulnerability scanner for container images and filesystems that serves as an excellent alternative to trivy fs.

Why Grype?

1. Supply Chain Diversity: Relying on multiple security scanners from different vendors (Aqua Security for Trivy, Anchore for Grype) reduces the risk of a single point of failure in the security supply chain.
2. Specialized Vulnerability Scanning: Grype is specifically optimized for scanning filesystems, SBOMs, and container images for vulnerabilities, often providing different or complementary results to Trivy.
3. SARIF Support: Grype natively supports SARIF output, making it easy to integrate with Trunk's reporting and GitHub's code scanning features.
4. Fast Performance: It is designed to be lightweight and fast, fitting well into Trunk's philosophy of high-performance linting and scanning.

Proposed Implementation

A basic plugin.yaml for grype would look similar to the following:

• Tools Definition: Download from Anchore's GitHub releases.
• Linter Definition:
  • Scan lockfiles and filesystems.
  • Output format: SARIF.
  • Command: grype file:${target} -o sarif.
  • Environment: Configure GRYPE_DB_CACHE_DIR to use Trunk's shared cache.

Acceptance Criteria

• grype is added as a supported linter in trunk-plugins.
• Users can enable grype via trunk check enable grype.
• grype correctly identifies vulnerabilities in common lockfiles (e.g., Gemfile.lock, package-lock.json).
• Output is correctly parsed and displayed in the Trunk CLI and IDE integrations.

References

• Trivy Security Advisory: GHSA-69fq-xp46-6x23
• Grype Repository: https://github.com/anchore/grype