SparkN0de-git - /page/commit.mu

Micron Document

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

| SparkN0de-git | SparkN0de |

Node / ReticulumProjects / MeshChatX.git / commits / b424a6d

Commit b424a6d4920e092a6ff31c93711eb8e07987d969

󰉖 Browse tree at this commit

Parents : da83df9

Author : Ivan <ivan@quad4.io>

Signature : Signature validation error

Date : 2026-05-02T05:25:49-05:00

chore(ci): update Trivy installation method and versioning in CI workflows

Changes

3 files changed, 15 insertions(+), 7 deletions(-)

M .github/workflows/build-release.yml +3 -2

M .github/workflows/security-scan.yml +3 -2

M scripts/ci/setup-trivy.sh +9 -3

Diff

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml

index 8fa9e993..969c85b4 100644

--- a/.github/workflows/build-release.yml

+++ b/.github/workflows/build-release.yml

@@ -40,8 +40,9 @@ env:

POETRY_VERSION: "2.3.4"

PNPM_VERSION: "10.33.0"

COSIGN_VERSION: "3.0.6"

- TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"

- TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"

+ # Official .deb from aquasecurity/trivy releases; scripts/ci/setup-trivy.sh verifies

+ # checksums.txt (sigstore) + .deb SHA256 + .deb (sigstore). Bump with upstream tags.

+ TRIVY_VERSION: "0.69.3"

jobs:

frontend:

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml

index ef62a6b1..6564eb24 100644

--- a/.github/workflows/security-scan.yml

+++ b/.github/workflows/security-scan.yml

@@ -32,8 +32,9 @@ env:

NODE_VERSION: "24"

POETRY_VERSION: "2.3.4"

PNPM_VERSION: "10.32.1"

- TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"

- TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"

+ COSIGN_VERSION: "3.0.6"

+ # Official .deb; setup-trivy.sh verifies sigstore + SHA256 (see build-release.yml).

+ TRIVY_VERSION: "0.69.3"

jobs:

scan:

diff --git a/scripts/ci/setup-trivy.sh b/scripts/ci/setup-trivy.sh

index 191a8029..e697a3b9 100644

--- a/scripts/ci/setup-trivy.sh

+++ b/scripts/ci/setup-trivy.sh

@@ -1,7 +1,13 @@

#!/bin/sh

-# Install Trivy .deb for CI (scan / docker workflows). Upstream path: Sigstore on

-# trivy_${VER}_checksums.txt, SHA256 of the .deb against that file, then Sigstore on the .deb.

-# Custom mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).

+# Install Trivy .deb for CI (scan / docker workflows).

+# Default (no TRIVY_DEB_URL): official assets from

+# https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/

+# 1) cosign verify-blob on trivy_${VER}_checksums.txt (+ .sigstore.json)

+# 2) sha256sum -c for the arch .deb using that checksums file

+# 3) cosign verify-blob on the .deb (+ .deb.sigstore.json)

+# Optional mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).

set -eu

COSIGN_VERSION="${COSIGN_VERSION:-3.0.6}"

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────