Getting started

This page covers installing Grype, building it from source, and the day-to-day commands you will use as a contributor.

Prerequisites

• Go 1.25.8 or newer (go.mod pins go 1.25.8).
• Docker (for image-based integration tests and snapshot builds).
• task — the project uses Taskfile.yaml instead of make. The binny bootstrap script will install the tool chain on first run.
• Python 3 — used by a couple of validation helpers under .github/scripts/ and test/quality/.

Install (end users)

curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin

Other delivery channels (Homebrew, Docker images on ghcr.io and docker.io, Chocolatey, MacPorts) are documented at https://oss.anchore.com/docs/installation/grype/.

Quick scan

# scan a container image (defaults to docker daemon)
grype alpine:latest

# scan a directory
grype dir:./my-project

# scan an SBOM
grype sbom:./sbom.json
cat ./sbom.json | grype

# only show fixed vulnerabilities
grype alpine:latest --only-fixed

The first run downloads vulnerability.db (hundreds of MB once decompressed) into `/.cache/grype/db/`.

Clone and build from source

git clone https://github.com/anchore/grype
cd grype

# bootstrap pinned developer tools (golangci-lint, goreleaser, bouncer, ...)
task tools

# build a snapshot binary into ./snapshot/
task build
./snapshot/$(uname -s | tr '[:upper:]' '[:lower:]')-build_*/grype --version

Or use go run directly for fast iteration:

go run ./cmd/grype alpine:latest
go run ./cmd/grype db status

Test loops

The Taskfile.yaml exposes the canonical test entry points.

Task	What it runs
task unit	go test ./... for everything except test/ and internal/test, with a 47% coverage threshold.
task integration	go test ./test/integration plus a live DB update and a real alpine:latest scan with the data race detector.
task cli	End-to-end CLI tests in test/cli/ against the snapshot binary.
task quality	Quality gate (test/quality/) using yardstick and vulnerability-match-labels.
task test	All of the above (unit + integration + cli).
task validate	static-analysis + test + install-test.

Static analysis

Task	What it runs
task lint	gofmt -l -s + golangci-lint run --tests=false. Config in .golangci.yaml.
task lint-fix	Auto-format then golangci-lint --fix.
task format	gofmt, gosimports, go mod tidy.
task check-go-mod-tidy	Fails if go.mod/go.sum are not tidy.
task check-licenses	bouncer check ./... against .bouncer.yaml.
task check-json-schema-drift	Verifies the JSON output schema matches generated code.
task check-db-schema-drift	Verifies database blob schemas match generated code.

Code generation

task generate              # all generators
task generate-json-schema  # CLI JSON output schema
task generate-db-schema    # v6 database blob schemas
task generate-codename-data

The OS codename data uses go generate ./grype/db. JSON schemas are written under cmd/grype/cli/commands/internal/jsonschema/ and grype/db/v6/schema/.

Releasing

task release

See RELEASE.md for the full process. Releases require approval on the release.yaml GitHub Actions workflow and produce GitHub releases plus container images on ghcr.io and dockerhub.

Common environment variables

• GRYPE_CHECK_FOR_APP_UPDATE=false — disable startup version check (the Taskfile already sets this for local dev).
• GRYPE_DB_AUTO_UPDATE=false — skip DB refresh.
• GRYPE_DB_CACHE_DIR=... — override DB cache path.
• GRYPE_LOG_LEVEL=debug|trace — verbosity.
• GRYPE_SNAPSHOT_PREBUILT=true — used in CI to skip the snapshot rebuild when restoring from cache.