Add workflow to run grype

Author: peterfpeterson

.github/workflows/grype.yml

@@ -0,0 +1,68 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, builds an image, performs a container image
+# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub
+# Advanced Security code scanning feature.  For more information on the Anchore scan
+# action usage and parameters, see https://github.com/anchore/scan-action. For more
+# information on Anchore's container image scanning tool Grype, see
+# https://github.com/anchore/grype
+name: vulnerability scan
+
+on:
+  push:
+    branches: ["next", "main", "qa"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["main"]
+  schedule:
+    - cron: '42 13 * * 3'
+
+env:
+  PKG_NAME: quicknxs
+
+permissions:
+  contents: read
+
+jobs:
+  scan-package:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      # only required for a private repository by github/codeql-action/upload-sarif
+      # to get the Action run status
+      actions: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install conda package
+        id: installer
+        uses: ./pkg-install
+        with:
+          # local-channel: /tmp/local-channel
+          package-name: ${{ env.PKG_NAME }}
+          extra-channels: neutrons mantid
+
+      - name: Check out grype config
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .grype.yaml
+          sparse-checkout-cone-mode: false
+
+      - name: Run the Anchore Grype scan action
+        uses: anchore/scan-action@v7
+        id: scan
+        with:
+          path: ${{ steps.installer.outputs.conda_install_dir }}
+          fail-build: false
+          only-fixed: true # don't create notifications for things without fixes
+      - name: Upload vulnerability report
+        uses: github/codeql-action/upload-sarif@v4
+        if: ${{ success() || failure() }} # if the previous step ran
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+      - name: Inspect action SARIF report
+        if: ${{ runner.debug == true }}
+        run: cat ${{ steps.scan.outputs.sarif }}