Configuration search path logic mismatches on ./config.yaml

[victor-li]

As defined in the https://github.com/anchore/grype/blob/main/README.md#configuration section, Grype should have the following configuration search paths:

• .grype.yaml
• .grype/config.yaml
• ~/.grype.yaml
• <XDG_CONFIG_HOME>/grype/config.yaml

and should not match on ./config.yaml.

On this line:

grype/internal/config/application.go

Line 212 in 4cda526

v.AddConfigPath(".")

the current directory is added to Viper's config paths, but is not removed from the config paths to check step 2.

[kzantow]

Hi @victor-li very nice find! It looks like we may not be replacing the path the right way, but instead appending to it. We'll add this to the backlog.

[kzantow]

This was fixed as part of the CLIO port: #1437