apiVersion: v2
name: bp-syft-grype
description: |
  Catalyst Blueprint scratch chart for Syft + Grype.

  Anchore does not publish a Helm chart for the syft/grype CLIs (the
  charts at https://charts.anchore.io are for Anchore Enterprise / Anchore
  Engine, not the open-source CLIs). This chart hand-wires the upstream
  `ghcr.io/anchore/syft` and `ghcr.io/anchore/grype` containers into a
  scheduled CronJob that:
    1. Generates an SBOM with Syft from a configurable image target.
    2. Scans the SBOM with Grype for CVEs.
    3. Writes the JSON report to a PVC (or stdout for log collection).

  Pairs with bp-trivy (operator-driven scans) — Syft+Grype is the
  CI-friendly, image-focused complement.
type: application
version: 1.0.0
appVersion: "v1.43.0"
keywords: [catalyst, blueprint, syft, grype, sbom, vulnerability, security]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io

# Scratch chart — Anchore publishes no Helm chart for the syft/grype CLIs,
# so the Catalyst overlay templates (CronJob + PVC + ServiceAccount) are
# entirely in templates/ in this chart. The `sigstore/common` library
# subchart below is included ONLY to satisfy the platform-wide
# blueprint-release.yaml hollow-chart gate (issue #181) — every umbrella
# MUST declare at least one dependency. `common` is a tiny library chart
# (helper templates only, zero runtime resources) and contributes nothing
# to the rendered manifests of bp-syft-grype.
dependencies:
  - name: common
    version: "0.1.3"
    repository: "https://sigstore.github.io/helm-charts"
