Different results between scan-action and grype run locally

[jacopolanzonidev]

My company uses Grype wrapped by your scan-action to detect vulnerabilities.

We currently observe a difference between what the scan-action's Grype finds as a GitHub Action and what we get by running Grype locally (installed through brew).

The version of Grype is the same (v0.63.0)

scan-action:

Grype locally:

[jacopolanzonidev]

Solution found. In my action I wasn't building the project into a jar file, and not all the vulnerabilities are found in that way.

[tgerla]

Thanks for letting us know!