Accept Alpine base OS packages as a documented grant license policy exception

[Copilot]

The daily container image scan reported 12 license policy violations for grafana/mcp-grafana:1.0.0-alpine. All 12 are Alpine base-image OS packages (GPL-2.0-only / MPL-2.0 / Zlib), which cannot be changed without replacing the upstream image.

Changes

• .grant.yaml — adds an ignore-packages list covering the Alpine base layer (busybox, busybox-binsh, apk-tools, libapk, alpine-baselayout, alpine-baselayout-data, musl-utils, scanelf, ssl_client, ca-certificates, ca-certificates-bundle, zlib), with a comment stating the rationale. The exception is by explicit package name rather than by license or glob, so the MIT/Apache-2.0/BSD/ISC allowlist still governs every other package in every scanned image.
• CONTRIBUTING.md — a "Container Base OS Packages" subsection under the dependency license policy, so the exception is discoverable from the doc that .grant.yaml references.

Scanning with the pinned scanner (anchore/grant:v0.6.8) against the pinned digest goes from noncompliant (12 denied, 0 ignored) to compliant (0 denied, 12 ignored). Note this applies repo-wide, so node:lts-alpine and any future Alpine-based image get the same treatment — which is the intent.

Not addressed: the 2 High vulnerabilities

google.golang.org/grpc (GHSA-hrxh-6v49-42gf) and golang.org/x/text (GO-2026-5970) are compiled into the upstream binary. The newest published release (v1.1.0) and upstream main both still pin grpc v1.80.0 and golang.org/x/text v0.37.0, so a tag bump would not remediate them:

$ curl -s https://raw.githubusercontent.com/grafana/mcp-grafana/main/go.mod | grep -E 'grpc v|x/text'
golang.org/x/text v0.37.0 // indirect
google.golang.org/grpc v1.80.0 // indirect

These need an upstream dependency bump and release; the daily compile --force-refresh-container-pins run will pick up a fixed image once one exists. An alternative to consider if we want these gone sooner is moving the component off the vendor image entirely — worth weighing separately from this policy change.

• Fixes [container-image-scan] Container findings for grafana/mcp-grafana #52451

[Copilot]

Pull request overview

Documents and configures license exceptions for Alpine base-image packages detected during container scans.

Changes:

• Adds Grant package-name exclusions for 12 Alpine packages.
• Documents the container base OS exception policy.

Show a summary per file

File	Description
.grant.yaml	Adds package exclusions, currently broader than Alpine images.
CONTRIBUTING.md	Documents the intended Alpine license exception.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.3