--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit 3fbaab913666c52c4138b9cd397938678fca2b92
Parents : 8e47de3
Author : Sudo-Ivan <ivan@quad4.io>
Signature : Signature validation error
Date : 2026-01-16T09:02:04-06:00
Move to scan.yml security scanning workflow and integrate Trivy better
Changes
3 files changed, 45 insertions(+), 30 deletions(-)
Diff
diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index c2d60bbf..f8ebc404 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -46,6 +46,14 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
+ - name: Download Trivy
+ run: |
+ curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
+ sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
+
+ - name: Trivy FS scan
+ run: trivy fs --exit-code 1 .
+
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: https://git.quad4.io/actions/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
@@ -70,11 +78,6 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- - name: Download Trivy
- run: |
- curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
- sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
-
- name: Scan Docker image
run: |
# Extract the first tag from the multi-line tags output
@@ -109,6 +112,14 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
+ - name: Download Trivy
+ run: |
+ curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
+ sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
+
+ - name: Trivy FS scan
+ run: trivy fs --exit-code 1 .
+
- name: Extract DEV metadata (tags, labels) for Docker
id: meta-dev
uses: https://git.quad4.io/actions/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
@@ -130,11 +141,6 @@ jobs:
tags: ${{ steps.meta-dev.outputs.tags }}
labels: ${{ steps.meta-dev.outputs.labels }}
- - name: Download Trivy
- run: |
- curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
- sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
-
- name: Scan Docker image (dev)
run: |
# Extract the first tag from the multi-line tags output
diff --git a/.gitea/workflows/osv-scheduled.yml b/.gitea/workflows/osv-scheduled.yml
deleted file mode 100644
index a3ea11fe..00000000
--- a/.gitea/workflows/osv-scheduled.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: OSV-Scanner Scheduled Scan
-
-on:
- schedule:
- - cron: "30 12 * * 1"
- push:
- branches: [master]
-
-permissions:
- contents: read
-
-jobs:
- scan-scheduled:
- runs-on: ubuntu-latest
- steps:
- - name: Checkout
- uses: https://git.quad4.io/actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
- - name: OSV scan
- run: bash scripts/osv_scan.sh
diff --git a/.gitea/workflows/scan.yml b/.gitea/workflows/scan.yml
new file mode 100644
index 00000000..b40301e8
--- /dev/null
+++ b/.gitea/workflows/scan.yml
@@ -0,0 +1,29 @@
+name: Security Scans
+
+on:
+ schedule:
+ - cron: "30 12 * * 1"
+ push:
+ branches: [master]
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ scan:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: https://git.quad4.io/actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+ - name: OSV scan
+ run: bash scripts/osv_scan.sh
+
+ - name: Download Trivy
+ run: |
+ curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
+ sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
+
+ - name: Trivy FS scan
+ run: trivy fs --exit-code 1 .
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────