CI: Behebt Architektur-Erkennung beim Download von TruffleHog/Trivy/OSV-Scanner

Runner im Gitea-Pool sind nicht garantiert amd64 (z. B. arm64 unter dem
Label "ubuntu-latest"). Die Installations-Schritte luden bisher hart
codiert amd64-Binaries, was auf arm64-Runnern mit "Exec format error"
fehlschlug. Erkennt jetzt die Architektur per uname -m und wählt das
passende Release-Asset; Cache-Keys enthalten die Architektur ebenfalls,
damit kein arm64-Runner einen amd64-Cache-Treffer bekommt.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/security-scan.yaml

@@ -22,6 +22,15 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
+      - name: Architektur des Runners ermitteln
+        id: detect-arch
+        run: |
+          case "$(uname -m)" in
+            x86_64) echo "arch=amd64" >> "$GITHUB_OUTPUT" ;;
+            aarch64|arm64) echo "arch=arm64" >> "$GITHUB_OUTPUT" ;;
+            *) echo "Nicht unterstützte Architektur: $(uname -m)" >&2; exit 1 ;;
+          esac
+
       - name: Lokales bin-Verzeichnis zum PATH hinzufügen
         run: |
           mkdir -p "$HOME/.local/bin"
@@ -32,13 +41,17 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.local/bin/trivy
-          key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }}
+          key: trivy-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.TRIVY_VERSION }}
 
       - name: Install Trivy
         if: steps.cache-trivy.outputs.cache-hit != 'true'
         run: |
+          case "${{ steps.detect-arch.outputs.arch }}" in
+            amd64) TRIVY_ARCH="64bit" ;;
+            arm64) TRIVY_ARCH="ARM64" ;;
+          esac
           curl -fsSL -o trivy.tar.gz \
-            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz"
           tar -xzf trivy.tar.gz trivy
           chmod +x trivy
           mv trivy "$HOME/.local/bin/trivy"
@@ -70,13 +83,13 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.local/bin/osv-scanner
-          key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }}
+          key: osv-scanner-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.OSV_SCANNER_VERSION }}
 
       - name: Install OSV-Scanner
         if: steps.cache-osv-scanner.outputs.cache-hit != 'true'
         run: |
           curl -fsSL -o "$HOME/.local/bin/osv-scanner" \
-            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_${{ steps.detect-arch.outputs.arch }}"
           chmod +x "$HOME/.local/bin/osv-scanner"
 
       - name: Run OSV-Scanner

.gitea/workflows/trufflehog-scan.yaml

@@ -19,6 +19,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Architektur des Runners ermitteln
+        id: detect-arch
+        run: |
+          case "$(uname -m)" in
+            x86_64) echo "arch=amd64" >> "$GITHUB_OUTPUT" ;;
+            aarch64|arm64) echo "arch=arm64" >> "$GITHUB_OUTPUT" ;;
+            *) echo "Nicht unterstützte Architektur: $(uname -m)" >&2; exit 1 ;;
+          esac
+
       - name: Lokales bin-Verzeichnis zum PATH hinzufügen
         run: |
           mkdir -p "$HOME/.local/bin"
@@ -29,13 +38,13 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ~/.local/bin/trufflehog
-          key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }}
+          key: trufflehog-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.TRUFFLEHOG_VERSION }}
 
       - name: Install TruffleHog
         if: steps.cache-trufflehog.outputs.cache-hit != 'true'
         run: |
           curl -fsSL -o trufflehog.tar.gz \
-            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_${{ steps.detect-arch.outputs.arch }}.tar.gz"
           tar -xzf trufflehog.tar.gz trufflehog
           chmod +x trufflehog
           mv trufflehog "$HOME/.local/bin/trufflehog"