remove workflows that update the code

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
chore(deps): update CPE dictionary index (#4689 )
2026-10-12 06:07:20 +02:00 · 2026-03-27 12:24:02 -04:00 · 2026-03-25 08:38:49 -04:00 · 2026-03-24 08:12:50 -04:00 · 2026-03-24 07:16:16 -04:00 · 2026-03-23 16:29:39 -04:00
1750 changed files with 14861 additions and 3921 deletions
@@ -2,7 +2,7 @@ tools:
  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
  - name: binny
    version:
-      want: v0.11.0
+      want: v0.12.0
    method: github-release
    with:
      repo: anchore/binny
@@ -18,7 +18,7 @@ tools:
  # used to sign mac binaries at release
  - name: quill
    version:
-      want: v0.5.1
+      want: v0.7.1
    method: github-release
    with:
      repo: anchore/quill
@@ -26,7 +26,7 @@ tools:
  # used for linting
  - name: golangci-lint
    version:
-      want: v2.7.2
+      want: v2.11.4
    method: github-release
    with:
      repo: golangci/golangci-lint
@@ -42,7 +42,7 @@ tools:
  # used for signing the checksums file at release
  - name: cosign
    version:
-      want: v3.0.3
+      want: v3.0.5
    method: github-release
    with:
      repo: sigstore/cosign
@@ -58,7 +58,7 @@ tools:
  # used to release all artifacts
  - name: goreleaser
    version:
-      want: v2.13.1
+      want: v2.14.3
    method: github-release
    with:
      repo: goreleaser/goreleaser
@@ -90,7 +90,7 @@ tools:
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.46.3
+      want: v3.49.1
    method: github-release
    with:
      repo: go-task/task
@@ -98,7 +98,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.83.2
+      want: v2.88.1
    method: github-release
    with:
      repo: cli/cli
@@ -106,7 +106,7 @@ tools:
  # used to upload test fixture cache
  - name: oras
    version:
-      want: v1.3.0
+      want: v1.3.1
    method: github-release
    with:
      repo: oras-project/oras
@@ -114,7 +114,7 @@ tools:
  # used to upload test fixture cache
  - name: yq
    version:
-      want: v4.50.1
+      want: v4.52.4
    method: github-release
    with:
      repo: mikefarah/yq
@@ -5,7 +5,7 @@ inputs:
  go-version:
    description: "Go version to install"
    required: true
-    default: ">= 1.24"
+    default: "1.26.x"
  go-dependencies:
    description: "Download go dependencies"
    required: true
@@ -13,7 +13,7 @@ inputs:
  cache-key-prefix:
    description: "Prefix all cache keys with this value"
    required: true
-    default: "181053ac82"
+    default: "53ac821810"
  download-test-fixture-cache:
    description: "Download test fixture cache from OCI and github actions"
    required: true
@@ -29,15 +29,16 @@ runs:
  using: "composite"
  steps:
    # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+    - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
      if: inputs.go-version != ''
      with:
        go-version: ${{ inputs.go-version }}
+        check-latest: true

    - name: Restore tool cache
      if: inputs.tools == 'true'
      id: tool-cache
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: ${{ github.workspace }}/.tool
        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
@@ -66,7 +67,7 @@ runs:

    - name: Restore ORAS cache from github actions
      if: inputs.download-test-fixture-cache == 'true'
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: ${{ github.workspace }}/.tmp/oras-cache
        key: ${{ inputs.cache-key-prefix }}-oras-cache
@@ -1,27 +1,59 @@
+# Dependabot configuration
+#
+# Grouping behavior (see inline comments for details):
+#   - Minor + patch updates: grouped into a single PR per ecosystem
+#   - Major version bumps: individual PR per dependency
+#   - Security updates: individual PR per dependency
+#
+# Note: "patch" refers to semver version bumps (1.2.3 -> 1.2.4), not security fixes.
+# Security updates are identified separately via GitHub's Advisory Database and
+# can be any version bump (patch, minor, or major) that fixes a known CVE.
+
 version: 2

 updates:

  - package-ecosystem: gomod
    directory: "/"
+    cooldown:
+      default-days: 7
    schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "friday"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
+    ignore:
+      - dependency-name: "github.com/aquasecurity/go-pep440-version"
+      - dependency-name: "github.com/aquasecurity/go-version"
+      - dependency-name: "github.com/knqyf263/go-apk-version"
+      - dependency-name: "github.com/knqyf263/go-deb-version"
+    groups:
+      go-minor-patch:
+        applies-to: version-updates  # security updates get individual PRs
+        patterns:
+          - "*"
+        update-types:  # major omitted, gets individual PRs
+          - "minor"
+          - "patch"

  - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/bootstrap"
+    cooldown:
+      default-days: 7
    schedule:
-      interval: "daily"
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-
-  - package-ecosystem: "github-actions"
-    directory: "/.github/actions/bootstrap"
-    schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "friday"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
+    groups:
+      actions-minor-patch:
+        applies-to: version-updates  # security updates get individual PRs
+        patterns:
+          - "*"
+        update-types:  # major omitted, gets individual PRs
+          - "minor"
+          - "patch"
@@ -6,7 +6,7 @@ if [ "$(git status --porcelain | wc -l)" -ne "0" ]; then
  exit 1
 fi

-if ! make generate-capabilities; then
+if ! make generate-capabilities REFRESH=false; then
  echo "Generating capability descriptions failed"
  exit 1
 fi
@@ -33,9 +33,9 @@ def is_git_tracked_or_untracked(directory):


 def find_test_fixture_dirs_with_images(base_dir):
-    """Find directories that contain 'test-fixtures' and at least one 'image-*' directory."""
+    """Find directories that contain 'testdata' and at least one 'image-*' directory."""
    for root, dirs, files in os.walk(base_dir):
-        if 'test-fixtures' in root:
+        if 'testdata' in root:
            image_dirs = [d for d in dirs if d.startswith('image-')]
            if image_dirs:
                yield os.path.realpath(root)
@@ -36,18 +36,19 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
      with:
        persist-credentials: false

    - name: Install Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c #v6.1.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0
      with:
        go-version-file: go.mod
+        check-latest: true

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 #v3.29.5
+      uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +59,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 #v3.29.5
+      uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -72,4 +73,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 #v3.29.5
+      uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
@@ -34,9 +34,11 @@ jobs:
      issues: write
    steps:

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
+          repository: anchore/syft # IMPORTANT! An additional protection that this is checking out code from the expected repository 
+          ref: main # IMPORTANT!  It is CRITICAL that this only ever considers the code from main and NEVER EVER from a fork.

      - run: python .github/scripts/labeler.py
        env:
@@ -21,10 +21,10 @@ on:
 jobs:
  quality-gate:
    environment: release
-    runs-on: ubuntu-24.04
    if: ${{ github.event.inputs.phase == 'all' }}
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -127,16 +127,21 @@ jobs:
          false

  release:
-    needs: [quality-gate]
-    runs-on: ubuntu-24.04
+    needs: [ quality-gate ]
    if: ${{ github.event.inputs.phase == 'all' }}
+    # runs-on.com: compute instances for parallel builds
+    #   spot disabled: reliability for build workflows (used for releases too)
+    #   goreleaser uses parallelism of 12, so we need more CPUs
+    #   s3-cache: faster actions cache
+    #   tmpfs: faster io-intensive workflows
+    runs-on: runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs
    permissions:
      contents: write
      packages: write
      # required for goreleaser signs section with cosign
      id-token: write
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: true
@@ -145,13 +150,13 @@ jobs:
        uses: ./.github/actions/bootstrap

      - name: Login to Docker Hub
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  #v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  #v4.0.0
        with:
          username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
          password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  #v3.5.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  #v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -181,24 +186,34 @@ jobs:
          # for updating brew formula in anchore/homebrew-syft
          GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}

-      - uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 #v0.20.11
+      - uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 #v0.23.0
        continue-on-error: true
        with:
          file: go.mod
          artifact-name: sbom.spdx.json

-      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
+      - name: Notify Slack of new release
+        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a #v2.1.1
        continue-on-error: true
        with:
-          status: ${{ job.status }}
-          fields: repo,workflow,action,eventName
-          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}"
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+          webhook: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          payload: |
+            text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}"
+            blocks:
+              - type: section
+                text:
+                  type: mrkdwn
+                  text: |
+                    *A new Syft release has been published* :rocket:
+                    • Release: <https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}|${{ github.event.inputs.version }}>
+                    • Repo: `${{ github.repository }}`
+                    • Workflow: `${{ github.workflow }}`
+                    • Event: `${{ github.event_name }}`
        if: ${{ success() }}

  release-install-script:
-    needs: [release]
+    needs: [ release ]
    if: ${{ always() && (needs.release.result == 'success' || github.event.inputs.phase == 'install-script-only') }}
    uses: "anchore/workflows/.github/workflows/release-install-script.yaml@main"
    with:
@@ -13,13 +13,16 @@ jobs:

  Publish:
    name: "Publish test fixture image cache"
-    # we use this runner to get enough storage space for docker images and fixture cache
-    runs-on: ubuntu-22.04-4core-16gb
+    # runs-on.com: general purpose instances for building test fixture cache
+    #   spot disabled: can run up to an hour, avoid interruptions
+    #   s3-cache: faster actions cache
+    #   family: note that m*d instances have local nvme storage which is beneficial for building large test fixture images
+    runs-on: "runs-on=${{ github.run_id }}/cpu=8+16/ram=32+64/family=m5d+m5ad+m5dn+m6gd+m6id+m6idn+m7gd+m8gd/spot=false/extras=s3-cache"
    if: github.repository == 'anchore/syft' # only run for main repo
    permissions:
      packages: write
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -1,51 +0,0 @@
-name: PR to update Anchore dependencies
-on:
-  workflow_dispatch:
-    inputs:
-      repos:
-        description: "List of dependencies to update"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'anchore' # only run for main repo (not forks)
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        with:
-          tools: false
-          bootstrap-apt-packages: ""
-
-      - name: Update dependencies
-        id: update
-        uses: anchore/workflows/.github/actions/update-go-dependencies@main
-        with:
-          repos: ${{ github.event.inputs.repos }}
-
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.TOKEN_APP_ID }}
-          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
-        with:
-          signoff: true
-          delete-branch: true
-          draft: ${{ steps.update.outputs.draft }}
-          # do not change this branch, as other workflows depend on it
-          branch: auto/integration
-          labels: dependencies,pre-release
-          commit-message: "chore(deps): update anchore dependencies"
-          title: "chore(deps): update anchore dependencies"
-          body: ${{ steps.update.outputs.summary }}
-          token: ${{ steps.generate-token.outputs.token }}
@@ -1,67 +0,0 @@
-name: PR for latest versions of tools
-on:
-  schedule:
-    - cron: "0 8 * * *" # 3 AM EST
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  update-bootstrap-tools:
-    runs-on: ubuntu-latest
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        with:
-          bootstrap-apt-packages: ""
-          go-dependencies: false
-
-      - name: "Update tool versions"
-        id: latest-versions
-        run: |
-          make update-tools
-          make list-tools
-          
-          export NO_COLOR=1
-          delimiter="$(openssl rand -hex 8)"
-          
-          {
-            echo "status<<${delimiter}"
-            make list-tool-updates
-            echo "${delimiter}"
-          } >> $GITHUB_OUTPUT
-          
-          {
-            echo "### Tool version status"
-            echo "\`\`\`"
-            make list-tool-updates
-            echo "\`\`\`"
-          } >> $GITHUB_STEP_SUMMARY
-
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.TOKEN_APP_ID }}
-          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-tools
-          labels: dependencies
-          commit-message: 'chore(deps): update tools to latest versions'
-          title: 'chore(deps): update tools to latest versions'
-          body: |
-            ```
-            ${{ steps.latest-versions.outputs.status }}
-            ```
-            This is an auto-generated pull request to update all of the tools to the latest versions.
-          token: ${{ steps.generate-token.outputs.token }}
@@ -1,74 +0,0 @@
-name: PR to update CPE dictionary index
-on:
-  schedule:
-    - cron: "0 1 * * 1" # every monday at 1 AM
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  SLACK_NOTIFICATIONS: true
-
-jobs:
-  upgrade-cpe-dictionary-index:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        id: bootstrap
-
-      - name: Login to GitHub Container Registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u "$ACTOR" --password-stdin
-        env:
-          ACTOR: ${{ github.actor }}
-
-      - name: Pull CPE cache from registry
-        run: make generate:cpe-index:cache:pull
-
-      - name: Update CPE cache from NVD API
-        run: make generate:cpe-index:cache:update
-        env:
-          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-
-      - name: Generate CPE dictionary index
-        run: make generate:cpe-index:build
-
-      - name: Push updated CPE cache to registry
-        run: make generate:cpe-index:cache:push
-
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.TOKEN_APP_ID }}
-          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-cpe-dictionary-index
-          labels: dependencies
-          commit-message: "chore(deps): update CPE dictionary index"
-          title: "chore(deps): update CPE dictionary index"
-          body: |
-            Update CPE dictionary index based on the latest available CPE dictionary
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
-        with:
-          status: ${{ job.status }}
-          fields: workflow,eventName,job
-          text: Syft CPE dictionary index update failed
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
-        if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }}
@@ -1,54 +0,0 @@
-name: PR to update SPDX license list
-on:
-  schedule:
-    - cron: "0 6 * * 1" # every monday at 6 AM UTC
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  SLACK_NOTIFICATIONS: true
-
-jobs:
-  upgrade-spdx-license-list:
-    runs-on: ubuntu-latest
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-
-      - run: |
-          make generate-license-list
-
-      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.TOKEN_APP_ID }}
-          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-spdx-license-list
-          labels: dependencies
-          commit-message: "chore(deps): update SPDX license list"
-          title: "chore(deps): update SPDX license list"
-          body: |
-            Update SPDX license list based on the latest available list from spdx.org
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0
-        with:
-          status: ${{ job.status }}
-          fields: workflow,eventName,job
-          text: Syft SPDX license list update failed
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
-        if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }}
@@ -23,13 +23,14 @@ jobs:
      contents: read
      security-events: write  # for uploading SARIF results
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
        with:
-          config-file: .github/zizmor.yml
-          sarif-upload: true
+          config: .github/zizmor.yml
+          # Disable SARIF upload so the step is a simple pass/fail gate
+          advanced-security: false
          inputs: .github
@@ -1,5 +1,7 @@
 name: "Validations"

+# we should cancel any in-progress runs for the same workflow + PR/ref
+# so that we can avoid redundant work / save on CI minutes
 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
@@ -12,16 +14,19 @@ on:
      - main

 permissions:
-    contents: read
+  contents: read

 jobs:
-
  Static-Analysis:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Static analysis"
-    runs-on: ubuntu-24.04
+    # runs-on.com: memory & general purpose instances for testing
+    #   spot enabled: ok to interrupt non-production workloads
+    #   s3-cache: faster actions cache
+    #   tmpfs: faster io-intensive workflows
+    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=32+128/family=r5+r6+r7+r8+m4+m5+m6+m7+m8/spot=price-capacity-optimized/extras=s3-cache+tmpfs"
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -36,14 +41,12 @@ jobs:
      - name: Run static analysis
        run: make static-analysis

-
  Unit-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Unit tests"
-    # we need more storage than what's on the default runner
-    runs-on: ubuntu-22.04-4core-16gb
+    runs-on: *test-runner
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -55,13 +58,15 @@ jobs:
      - name: Run unit tests
        run: make unit

+      - name: Check for capability drift
+        run: make check-capability-drift

  Integration-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Integration tests"
-    runs-on: ubuntu-24.04
+    runs-on: *test-runner
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -76,12 +81,19 @@ jobs:
      - name: Run integration tests
        run: make integration

-
  Build-Snapshot-Artifacts:
    name: "Build snapshot artifacts"
-    runs-on: ubuntu-24.04
+    # runs-on.com: compute instances for parallel builds
+    #   spot disabled: reliability for build workflows (used for releases too)
+    #   goreleaser uses parallelism of 12, so we need more CPUs
+    #   s3-cache: faster actions cache
+    #   tmpfs: faster io-intensive workflows
+    runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs"
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
+      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e  # v2.0.3
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -96,84 +108,23 @@ jobs:
      - name: Smoke test snapshot build
        run: make snapshot-smoke-test

-      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
-      # see https://github.com/actions/upload-artifact/issues/199 for more info
      - name: Upload snapshot artifacts
-        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
        with:
-          # we need to preserve the snapshot data itself as well as the task data that confirms if the
-          # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
-          # even though it already exists.
-          path: |
-            snapshot
-            .task
-          key: snapshot-build-${{ github.run_id }}
-
-
-  Upload-Snapshot-Artifacts:
-    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
-    name: "Upload snapshot artifacts"
-    needs: [Build-Snapshot-Artifacts]
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        with:
-          download-test-fixture-cache: true
-
-      - name: Download snapshot build
-        id: snapshot-cache
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
-        with:
-          path: |
-            snapshot
-            .task
-          fail-on-cache-miss: true
-          key: snapshot-build-${{ github.run_id }}
-
-      # workaround for https://github.com/actions/cache/issues/1265
-      - name: (cache-miss) Snapshot build missing
-        if: steps.snapshot-cache.outputs.cache-hit != 'true'
-        run: echo "unable to download snapshots from previous job" && false
-
-      - run: npm install @actions/artifact@2.2.2
-
-      - uses: actions/github-script@v8
-        with:
-          script: |
-            const { readdirSync } = require('fs')
-            const { DefaultArtifactClient } = require('@actions/artifact')
-            const artifact = new DefaultArtifactClient()
-            const ls = d => readdirSync(d, { withFileTypes: true })
-            const baseDir = "./snapshot"
-            const dirs = ls(baseDir).filter(f => f.isDirectory()).map(f => f.name)
-            const uploads = []
-            for (const dir of dirs) {
-              // uploadArtifact returns Promise<{id, size}>
-              uploads.push(artifact.uploadArtifact(
-                // name of the archive:
-                `${dir}`,
-                // array of all files to include:
-                ls(`${baseDir}/${dir}`).map(f => `${baseDir}/${dir}/${f.name}`),
-                // base directory to trim from entries:
-                `${baseDir}/${dir}`,
-                { retentionDays: 30 }
-              ))
-            }
-            // wait for all uploads to finish
-            Promise.all(uploads)
+          name: snapshot
+          path: snapshot/
+          retention-days: 30

  Acceptance-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Linux)"
    needs: [Build-Snapshot-Artifacts]
-    runs-on: ubuntu-24.04
+    runs-on: *test-runner
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
+      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e  # v2.0.3
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -182,20 +133,14 @@ jobs:
        with:
          download-test-fixture-cache: true

-      - name: Download snapshot build
-        id: snapshot-cache
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
+      - name: Download snapshot artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
        with:
-          path: |
-            snapshot
-            .task
-          fail-on-cache-miss: true
-          key: snapshot-build-${{ github.run_id }}
+          name: snapshot
+          path: snapshot

-      # workaround for https://github.com/actions/cache/issues/1265
-      - name: (cache-miss) Snapshot build missing
-        if: steps.snapshot-cache.outputs.cache-hit != 'true'
-        run: echo "unable to download snapshots from previous job" && false
+      - name: Restore binary permissions
+        run: chmod +x snapshot/*/syft snapshot/*/*.exe 2>/dev/null || true

      - name: Run comparison tests (Linux)
        run: make compare-linux
@@ -211,17 +156,17 @@ jobs:
        if: steps.install-test-image-cache.outputs.cache-hit != 'true'
        run: make install-test-cache-save

-
  Acceptance-Mac:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Mac)"
    needs: [Build-Snapshot-Artifacts]
+    # note: macos runners aren't supported yet for runs-on managed runners.
    runs-on: macos-latest
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -232,20 +177,14 @@ jobs:
          go-dependencies: false
          download-test-fixture-cache: true

-      - name: Download snapshot build
-        id: snapshot-cache
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
+      - name: Download snapshot artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
        with:
-          path: |
-            snapshot
-            .task
-          fail-on-cache-miss: true
-          key: snapshot-build-${{ github.run_id }}
+          name: snapshot
+          path: snapshot

-      # workaround for https://github.com/actions/cache/issues/1265
-      - name: (cache-miss) Snapshot build missing
-        if: steps.snapshot-cache.outputs.cache-hit != 'true'
-        run: echo "unable to download snapshots from previous job" && false
+      - name: Restore binary permissions
+        run: chmod +x snapshot/*/syft 2>/dev/null || true

      - name: Run comparison tests (Mac)
        run: make compare-mac
@@ -253,14 +192,16 @@ jobs:
      - name: Run install.sh tests (Mac)
        run: make install-test-ci-mac

-
  Cli-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "CLI tests (Linux)"
    needs: [Build-Snapshot-Artifacts]
-    runs-on: ubuntu-24.04
+    runs-on: *test-runner
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
+      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e  # v2.0.3
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

@@ -269,42 +210,14 @@ jobs:
        with:
          download-test-fixture-cache: true

-      - name: Download snapshot build
-        id: snapshot-cache
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #v5.0.1
+      - name: Download snapshot artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
        with:
-          path: |
-            snapshot
-            .task
-          fail-on-cache-miss: true
-          key: snapshot-build-${{ github.run_id }}
+          name: snapshot
+          path: snapshot

-      # workaround for https://github.com/actions/cache/issues/1265
-      - name: (cache-miss) Snapshot build missing
-        if: steps.snapshot-cache.outputs.cache-hit != 'true'
-        run: echo "unable to download snapshots from previous job" && false
+      - name: Restore binary permissions
+        run: chmod +x snapshot/*/syft snapshot/*/*.exe 2>/dev/null || true

      - name: Run CLI Tests (Linux)
        run: make cli
-
-
-  Cleanup-Cache:
-    name: "Cleanup snapshot cache"
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs:
-      - Acceptance-Linux
-      - Acceptance-Mac
-      - Cli-Linux
-      - Upload-Snapshot-Artifacts
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Delete snapshot cache
-        run: gh cache delete "snapshot-build-${{ github.run_id }}"
-        env:
-          GH_TOKEN: ${{ github.token }}
@@ -1,9 +1,9 @@
 rules:
  unpinned-uses:
-    ignore:
-      # Allow unpinned uses of trusted internal anchore/workflows actions
-      - update-anchore-dependencies.yml
-
+    config:
+      policies:
+        # anchore/workflows is an internal repository; using @main is acceptable
+        anchore/*: any
  dangerous-triggers:
    ignore:
      # Safe use of pull_request_target - only runs trusted scripts from base repo,
@@ -19,6 +19,7 @@ bin/
 /.task
 /generate
 /specs
+mise.toml

 # changelog generation
 CHANGELOG.md
@@ -36,6 +37,7 @@ VERSION
 coverage.txt
 *.log
 **/test-fixtures/test-observations.json
+**/testdata/test-observations.json

 # probable archives
 .images
@@ -50,10 +50,9 @@ linters:
      - legacy
      - std-error-handling
    rules:
-      # internal/os contains OS feature detection logic; the name reflects its purpose
+      # we have multiple packages in syft that might overlap with the stblib; their names reflect their purpose
      - linters:
          - revive
-        path: internal/os/
        text: "var-naming: avoid package names that conflict"
    paths:
      - third_party$
@@ -8,7 +8,9 @@ vars:
  OWNER: anchore
  PROJECT: syft

-  CACHE_IMAGE: ghcr.io/{{ .OWNER }}/{{ .PROJECT }}/test-fixture-cache:latest
+  # v1: when fixtures were located at test-fixtures dirs
+  # v2: migration to testdata dirs
+  CACHE_IMAGE: ghcr.io/{{ .OWNER }}/{{ .PROJECT }}/test-fixture-cache:v2

  # static file dirs
  TOOL_DIR: .tool
@@ -73,7 +75,6 @@ tasks:
      - task: check-licenses
      - task: lint
      - task: check-json-schema-drift
-      - task: check-capability-drift
      - task: check-binary-fixture-size

  test:
@@ -199,7 +200,7 @@ tasks:
  check-binary-fixture-size:
    desc: Ensure that the binary test fixtures are not too large
    cmds:
-      - .github/scripts/check_binary_fixture_size.sh syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets
+      - .github/scripts/check_binary_fixture_size.sh syft/pkg/cataloger/binary/testdata/classifiers/snippets


  ## Testing tasks #################################
@@ -266,9 +267,9 @@ tasks:
  fingerprints:
    desc: Generate fingerprints for all non-docker test fixture
    silent: true
-    # this will look for `test-fixtures/Makefile` and invoke the `fingerprint` target to calculate all cache input fingerprint files
+    # this will look for `testdata/Makefile` and invoke the `fingerprint` target to calculate all cache input fingerprint files
    generates:
-      - '**/test-fixtures/**/*.fingerprint'
+      - '**/testdata/**/*.fingerprint'
      - test/install/cache.fingerprint
    cmds:
      - |
@@ -277,7 +278,7 @@ tasks:
        RESET='\033[0m'

        echo -e "${YELLOW}creating fingerprint files for non-docker fixtures...${RESET}"
-        for dir in $(find . -type d -name 'test-fixtures'); do
+        for dir in $(find . -type d -name 'testdata'); do
          if [ -f "$dir/Makefile" ]; then
            # for debugging...
            #echo -e "${YELLOW}• calculating fingerprints in $dir... ${RESET}"
@@ -370,18 +371,21 @@ tasks:
  build-fixtures:
    desc: Generate all non-docker test fixtures
    silent: true
-    # this will look for `test-fixtures/Makefile` and invoke the `fixtures` target to generate any and all test fixtures
+    # this will look for `testdata/Makefile` and invoke the `fixtures` target to generate any and all test fixtures
    cmds:
      - |
+        # we want to stop on the first build error
+        set -e
+
        BOLD='\033[1m'
        YELLOW='\033[0;33m'
        RESET='\033[0m'

        # Use a for loop with command substitution to avoid subshell issues
-        for dir in $(find . -type d -name 'test-fixtures'); do
+        for dir in $(find . -type d -name 'testdata'); do
          if [ -f "$dir/Makefile" ]; then
            echo -e "${YELLOW}${BOLD}generating fixtures in $dir${RESET}"
-            (make -C "$dir" fixtures)
+            make -C "$dir" fixtures
          fi
        done
        echo -e "${BOLD}generated all fixtures${RESET}"
@@ -432,7 +436,7 @@ tasks:
      - "echo 'Docker daemon cache:'"
      - "docker images --format '{{`{{.ID}}`}} {{`{{.Repository}}`}}:{{`{{.Tag}}`}}' | grep stereoscope-fixture- | sort"
      - "echo '\nTar cache:'"
-      - 'find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" | sort'
+      - 'find . -type f -wholename "**/testdata/cache/stereoscope-fixture-*.tar" | sort'

  check-docker-cache:
    desc: Ensure docker caches aren't using too much disk space
@@ -466,7 +470,7 @@ tasks:
      - "cd test/install && make ci-test-mac"

  generate-compare-file:
-    cmd: "go run ./cmd/syft {{ .COMPARE_TEST_IMAGE }} -o json > {{ .COMPARE_DIR }}/test-fixtures/acceptance-{{ .COMPARE_TEST_IMAGE }}.json"
+    cmd: "go run ./cmd/syft {{ .COMPARE_TEST_IMAGE }} -o json > {{ .COMPARE_DIR }}/testdata/acceptance-{{ .COMPARE_TEST_IMAGE }}.json"

  compare-mac:
    deps: [tmpdir]
@@ -534,15 +538,21 @@ tasks:
    deps:
      - tmpdir
      - fixtures
+    vars:
+      # set REFRESH=true to run package tests first and refresh test observations (default: true)
+      REFRESH: '{{ .REFRESH | default "true" }}'
    cmds:
      # remove all test observations prior to regenerating
      - task: clean-test-observations
+        if: '{{ eq .REFRESH "true" }}'
      # this is required to update test observations; such evidence is used to update the packages/*.yaml
-      - "go test ./syft/pkg/... -count=1"
+      - cmd: "go test ./syft/pkg/... -count=1"
+        if: '{{ eq .REFRESH "true" }}'
      - "go generate ./internal/capabilities/..."
      - "gofmt -s -w ./internal/capabilities"
      # now that we have the latest capabilities, run completeness tests to ensure this is self-consistent
-      - "SYFT_ENABLE_COMPLETENESS_TESTS=true go test ./internal/capabilities/... -count=1"
+      # note: -p 1 forces sequential package execution to avoid race between generate (writes) and internal (reads)
+      - "SYFT_ENABLE_COMPLETENESS_TESTS=true go test -p 1 ./internal/capabilities/... -count=1"


  ## Build-related targets #################################
@@ -635,6 +645,15 @@ tasks:

  ## Cleanup targets #################################

+  clean:
+    desc: Remove all cache files and old builds
+    cmds:
+      - task: clean-snapshot
+      - task: clean-cache
+      - task: clean-test-observations
+      - task: clean-docker-cache
+      - task: clean-oras-cache
+
  clean-snapshot:
    desc: Remove any snapshot builds
    cmds:
@@ -644,7 +663,7 @@ tasks:
  clean-docker-cache:
    desc: Remove all docker cache tars and images from the daemon
    cmds:
-      - find . -type d -wholename "**/test-fixtures/cache" | xargs rm -rf
+      - find . -type d -wholename "**/testdata/cache" | xargs rm -rf
      - docker images --format '{{`{{.ID}}`}} {{`{{.Repository}}`}}' | grep stereoscope-fixture- | awk '{print $1}' | uniq | xargs -r docker rmi --force

  clean-oras-cache:
@@ -661,7 +680,7 @@ tasks:
        RESET='\033[0m'

        # Use a for loop with command substitution to avoid subshell issues
-        for dir in $(find . -type d -name 'test-fixtures'); do
+        for dir in $(find . -type d -name 'testdata'); do
        if [ -f "$dir/Makefile" ]; then
          echo -e "${YELLOW}${BOLD}deleting ephemeral test fixtures in $dir${RESET}"
          (make -C "$dir" clean)
@@ -671,6 +690,6 @@ tasks:
      - rm -f {{ .LAST_CACHE_PULL_FILE }} {{ .CACHE_PATHS_FILE }}

  clean-test-observations:
-    desc: Remove all test observations (i.e. test-fixtures/test-observations.json)
+    desc: Remove all test observations (i.e. testdata/test-observations.json)
    cmds:
-      - find . -type f -wholename "**/test-fixtures/test-observations.json" | xargs rm -f
+      - find . -type f -wholename "**/testdata/test-observations.json" | xargs rm -f
@@ -219,7 +219,7 @@ func (l attestLogFrame) View() string {
 	sb := strings.Builder{}

 	for _, line := range l.lines {
-		sb.WriteString(fmt.Sprintf("     %s %s\n", l.borderStype.Render("░░"), line))
+		fmt.Fprintf(&sb, "     %s %s\n", l.borderStype.Render("░░"), line)
 	}

 	return sb.String()
@@ -49,7 +49,7 @@ func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig
 			},
 		).
 		WithPostRuns(func(_ *clio.State, _ error) {
-			stereoscope.Cleanup()
+			stereoscope.Cleanup() //nolint:staticcheck // we don't have access to the image object here
 		})
 	return clioCfg
 }
@@ -59,7 +59,9 @@ const (
 	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                  read directly from a path on disk (any directory)
    {{.appName}} {{.command}} file:path/to/yourproject/file            read directly from a path on disk (any single file)
 `
-	scanSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
+	modelSchemeHelp = `    {{.appName}} {{.command}} oci-model-registry:ai/llama3.2           scan an OCI model artifact from a registry (e.g. Docker Hub AI models)
+`
+	scanSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp + modelSchemeHelp + nonImageSchemeHelp

 	scanHelp = scanExample + scanSchemeHelp
 )
@@ -19,30 +19,30 @@ func Test_scanOptions_validateLegacyOptionsNotUsed(t *testing.T) {
 		},
 		{
 			name: "config file with no legacy options",
-			cfg:  "test-fixtures/scan-configs/no-legacy-options.yaml",
+			cfg:  "testdata/scan-configs/no-legacy-options.yaml",
 		},
 		{
 			name:    "config file with default image pull source legacy option",
-			cfg:     "test-fixtures/scan-configs/with-default-pull-source.yaml",
+			cfg:     "testdata/scan-configs/with-default-pull-source.yaml",
 			wantErr: assertErrorContains("source.image.default-pull-source"),
 		},
 		{
 			name:    "config file with exclude-binary-overlap-by-ownership legacy option",
-			cfg:     "test-fixtures/scan-configs/with-exclude-binary-overlap-by-ownership.yaml",
+			cfg:     "testdata/scan-configs/with-exclude-binary-overlap-by-ownership.yaml",
 			wantErr: assertErrorContains("package.exclude-binary-overlap-by-ownership"),
 		},
 		{
 			name:    "config file with file string legacy option",
-			cfg:     "test-fixtures/scan-configs/with-file-string.yaml",
+			cfg:     "testdata/scan-configs/with-file-string.yaml",
 			wantErr: assertErrorContains("outputs"),
 		},
 		{
 			name: "config file with file section",
-			cfg:  "test-fixtures/scan-configs/with-file-section.yaml",
+			cfg:  "testdata/scan-configs/with-file-section.yaml",
 		},
 		{
 			name:    "config file with base-path legacy option",
-			cfg:     "test-fixtures/scan-configs/with-base-path.yaml",
+			cfg:     "testdata/scan-configs/with-base-path.yaml",
 			wantErr: assertErrorContains("source.base-path"),
 		},
 	}
@@ -107,7 +107,7 @@ func fetchLatestApplicationVersion(id clio.Identification) (*hashiVersion.Versio
 		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
 	}

-	versionBytes, err := io.ReadAll(resp.Body)
+	versionBytes, err := io.ReadAll(io.LimitReader(resp.Body, 500))
 	if err != nil {
 		return nil, fmt.Errorf("failed to read latest version: %w", err)
 	}
@@ -122,7 +122,7 @@ func formatVersionOptions(nameVersionPairs []string) string {
 	for _, name := range sortedAvailableFormats {
 		s.WriteString("\n")

-		s.WriteString(fmt.Sprintf("   - %s", name))
+		fmt.Fprintf(&s, "   - %s", name)

 		if len(availableVersions[name]) > 0 {
 			s.WriteString(" @ ")
@@ -125,7 +125,7 @@ func TestPkgCoverageImage(t *testing.T) {
 }

 func TestPkgCoverageDirectory(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "test-fixtures/image-pkg-coverage")
+	sbom, _ := catalogDirectory(t, "testdata/image-pkg-coverage")

 	observedLanguages := strset.New()
 	definedLanguages := strset.New()
@@ -261,7 +261,7 @@ func TestPkgCoverageImage_HasEvidence(t *testing.T) {
 }

 func TestPkgCoverageDirectory_HasEvidence(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "test-fixtures/image-pkg-coverage")
+	sbom, _ := catalogDirectory(t, "testdata/image-pkg-coverage")

 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -22,7 +22,7 @@ import (
 func TestFileCataloging_Default(t *testing.T) {
 	cfg := options.DefaultCatalog().ToSBOMConfig(clio.Identification{})
 	cfg = cfg.WithFilesConfig(filecataloging.DefaultConfig())
-	sbom, _ := catalogDirectoryWithConfig(t, "test-fixtures/files", cfg)
+	sbom, _ := catalogDirectoryWithConfig(t, "testdata/files", cfg)

 	var metadata map[file.Coordinates]file.Metadata

@@ -48,13 +48,13 @@ func TestFileCataloging_AllFiles(t *testing.T) {
 			SkipFilesAboveSize: 30,
 		},
 	})
-	sbom, _ := catalogDirectoryWithConfig(t, "test-fixtures/files", cfg)
+	sbom, _ := catalogDirectoryWithConfig(t, "testdata/files", cfg)

 	pwd, err := os.Getwd()
 	require.NoError(t, err)

 	testPath := func(path string) string {
-		return filepath.Join(pwd, "test-fixtures/files", path)
+		return filepath.Join(pwd, "testdata/files", path)
 	}

 	metadata := map[file.Coordinates]file.Metadata{
@@ -11,7 +11,7 @@ import (
 )

 func TestNpmPackageLockDirectory(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "test-fixtures/npm-lock")
+	sbom, _ := catalogDirectory(t, "testdata/npm-lock")

 	foundPackages := strset.New()

@@ -32,10 +32,11 @@ func TestNpmPackageLockDirectory(t *testing.T) {
 }

 func TestYarnPackageLockDirectory(t *testing.T) {
-	sbom, _ := catalogDirectory(t, "test-fixtures/yarn-lock")
+	sbom, _ := catalogDirectory(t, "testdata/yarn-lock")

 	foundPackages := strset.New()
-	expectedPackages := strset.New("async@0.9.2", "async@3.2.3", "merge-objects@1.0.5", "should-type@1.3.0", "@4lolo/resize-observer-polyfill@1.5.2")
+	// merge-objects and should-type are devDependencies in package.json and are excluded by default
+	expectedPackages := strset.New("async@0.9.2", "async@3.2.3", "@4lolo/resize-observer-polyfill@1.5.2")

 	for actualPkg := range sbom.Artifacts.Packages.Enumerate(pkg.NpmPkg) {
 		for _, actualLocation := range actualPkg.Locations.ToSlice() {
@@ -26,7 +26,7 @@ func TestBinaryElfRelationships(t *testing.T) {
 	}

 	// run the test...
-	sbom, _ := catalogFixtureImage(t, "elf-test-fixtures", source.SquashedScope)
+	sbom, _ := catalogFixtureImage(t, "elf-testdata", source.SquashedScope)

 	// get a mapping of package names to their IDs
 	nameToId := map[string]artifact.ID{}
@@ -278,7 +278,7 @@ func packageCatalogerExports(t *testing.T) map[string]exportTokenSet {
 		if info.IsDir() ||
 			!strings.HasSuffix(info.Name(), ".go") ||
 			strings.HasSuffix(info.Name(), "_test.go") ||
-			strings.Contains(path, "test-fixtures") ||
+			strings.Contains(path, "testdata") ||
 			strings.Contains(path, "internal") {
 			return nil
 		}
@@ -1 +0,0 @@
-../../../../../../syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures
@@ -1 +0,0 @@
-See the syft/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.
@@ -1,5 +1,5 @@
 # we should strive to not commit blobs to the repo and strive to keep the build process of how blobs are acquired in-repo.
-# this blob is generated from syft/syft/catalogers/java/test-fixtures/java-builds , however, preserving the build process
+# this blob is generated from syft/syft/catalogers/java/testdata/java-builds , however, preserving the build process
 # twice in the repo seems redundant (even via symlink). Given that the fixture is a few kilobytes in size, the build process is already
 # captured, and integration tests should only be testing if jars can be discovered (not necessarily depth in java detection
 # functionality), committing it seems like an acceptable exception.
@@ -0,0 +1 @@
+../../../../../../syft/pkg/cataloger/binary/testdata/elf-testdata
@@ -0,0 +1 @@
+See the syft/cataloger/java/testdata/java-builds dir to generate test fixtures and copy to here manually.
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`../../../../../../syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures`
				`@@ -1 +0,0 @@`
				`See the syft/cataloger/java/test-fixtures/java-builds dir to generate test fixtures and copy to here manually.`
				`@@ -0,0 +1 @@`
				`../../../../../../syft/pkg/cataloger/binary/testdata/elf-testdata`
				`@@ -0,0 +1 @@`
				`See the syft/cataloger/java/testdata/java-builds dir to generate test fixtures and copy to here manually.`