From 186251e21abf5a153d89819c86e77f89dcc35ead Mon Sep 17 00:00:00 2001 From: DragonSlayer_14 Date: Thu, 10 Sep 2026 19:28:40 +0200 Subject: [PATCH] Fix: Trivy manuell via curl installieren statt trivy-action/setup-trivy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setup-trivy's Install-Step macht immer einen git clone von aquasecurity/trivy gegen github.com, unabhängig vom Cache-Status. Das scheitert im Gitea act_runner mit "could not read Username for 'https://github.com'", da der Git-Smart-HTTP-Handshake blockiert wird. Plain curl-Downloads von GitHub-Release-Assets funktionieren dagegen (siehe OSV-Scanner-Step), daher wird Trivy jetzt genauso installiert. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Kh9v73QApBwJj96w6A8R55 --- .gitea/workflows/security-scan.yaml | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/security-scan.yaml b/.gitea/workflows/security-scan.yaml index 058bd9d..2084812 100644 --- a/.gitea/workflows/security-scan.yaml +++ b/.gitea/workflows/security-scan.yaml @@ -19,16 +19,26 @@ jobs: - name: Checkout Repository uses: actions/checkout@v7 + - name: Install Trivy + env: + TRIVY_VERSION: "0.70.0" + run: | + curl -fsSL -o trivy.tar.gz \ + "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" + tar -xzf trivy.tar.gz trivy + chmod +x trivy + sudo mv trivy /usr/local/bin/trivy + rm -f trivy.tar.gz + - name: Run Trivy Scanner - uses: aquasecurity/trivy-action@v0.36.0 - with: - scan-type: fs - scan-ref: . - scanners: vuln,secret,misconfig - severity: CRITICAL,HIGH - format: json - output: trivy-results.json - exit-code: "0" + run: | + trivy fs \ + --scanners vuln,secret,misconfig \ + --severity CRITICAL,HIGH \ + --format json \ + --output trivy-results.json \ + --exit-code 0 \ + . - name: Install OSV-Scanner run: |