CI: actions/cache@v6 fuer Cargo- und Scanner-Binaries ergaenzt

- main.yaml/testing.yaml: Cargo-Registry & target/ ueber Cargo.lock-Hash
  gecacht (groesster Zeitfresser bei 3 Cross-Compile-Targets)
- security-scan.yaml: Trivy- und OSV-Scanner-Binary versionsbasiert
  gecacht, zusaetzlich Trivy-Vulnerability-DB tagesbasiert gecacht
  (sonst voller OCI-Download bei jedem Lauf)
- trufflehog-scan.yaml: TruffleHog-Binary versionsbasiert gecacht

Installation aller drei Scanner-Binaries von sudo-basiertem
/usr/local/bin auf $HOME/.local/bin umgestellt, da actions/cache
sonst ohne sudo nicht zuverlaessig in root-Verzeichnisse restoren
kann. TRIVY_VERSION/OSV_SCANNER_VERSION/TRUFFLEHOG_VERSION dafuer auf
Job-Ebene verschoben (Cache-Steps brauchen sie fuer den Cache-Key);
die Renovate-customManagers-Regexe matchen weiterhin, da sie auf dem
rohen Dateitext arbeiten statt auf der YAML-Struktur.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kh9v73QApBwJj96w6A8R55

.gitea/workflows/main.yaml

@@ -19,6 +19,17 @@ jobs:
           toolchain: stable
           cache: false
 
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
       - name: Install Cross-Compilation Toolchains & Dependencies
         run: |
           sudo apt-get update

.gitea/workflows/security-scan.yaml

@@ -15,21 +15,46 @@ jobs:
   security-scan:
     name: Trivy & OSV-Scanner
     runs-on: ubuntu-latest
+    env:
+      TRIVY_VERSION: "0.74.0"
+      OSV_SCANNER_VERSION: "2.5.1"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Trivy-Binary
+        id: cache-trivy
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trivy
+          key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }}
+
       - name: Install Trivy
-        env:
-          TRIVY_VERSION: "0.74.0"
+        if: steps.cache-trivy.outputs.cache-hit != 'true'
         run: |
           curl -fsSL -o trivy.tar.gz \
             "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
           tar -xzf trivy.tar.gz trivy
           chmod +x trivy
-          sudo mv trivy /usr/local/bin/trivy
+          mv trivy "$HOME/.local/bin/trivy"
           rm -f trivy.tar.gz
 
+      - name: Ermittle Cache-Datum für Trivy-DB
+        run: echo "CACHE_DATE=$(date -u +%Y-%m-%d)" >> "$GITHUB_ENV"
+
+      - name: Cache Trivy-Schwachstellen-Datenbank
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ runner.os }}-${{ env.CACHE_DATE }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
+
       - name: Run Trivy Scanner
         run: |
           trivy fs \
@@ -40,13 +65,19 @@ jobs:
             --exit-code 0 \
             .
 
+      - name: Cache OSV-Scanner-Binary
+        id: cache-osv-scanner
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/osv-scanner
+          key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }}
+
       - name: Install OSV-Scanner
-        env:
-          OSV_SCANNER_VERSION: "2.5.1"
+        if: steps.cache-osv-scanner.outputs.cache-hit != 'true'
         run: |
-          curl -fsSL -o /usr/local/bin/osv-scanner \
+          curl -fsSL -o "$HOME/.local/bin/osv-scanner" \
             "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
-          chmod +x /usr/local/bin/osv-scanner
+          chmod +x "$HOME/.local/bin/osv-scanner"
 
       - name: Run OSV-Scanner
         run: |

.gitea/workflows/testing.yaml

@@ -19,6 +19,17 @@ jobs:
           toolchain: stable
           cache: false
 
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
       - name: Install Cross-Compilation Toolchains & Dependencies
         run: |
           sudo apt-get update

.gitea/workflows/trufflehog-scan.yaml

@@ -11,21 +11,34 @@ jobs:
   trufflehog-scan:
     name: TruffleHog
     runs-on: ubuntu-latest
+    env:
+      TRUFFLEHOG_VERSION: "3.97.4"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache TruffleHog-Binary
+        id: cache-trufflehog
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trufflehog
+          key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }}
+
       - name: Install TruffleHog
-        env:
-          TRUFFLEHOG_VERSION: "3.97.4"
+        if: steps.cache-trufflehog.outputs.cache-hit != 'true'
         run: |
           curl -fsSL -o trufflehog.tar.gz \
             "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
           tar -xzf trufflehog.tar.gz trufflehog
           chmod +x trufflehog
-          sudo mv trufflehog /usr/local/bin/trufflehog
+          mv trufflehog "$HOME/.local/bin/trufflehog"
           rm trufflehog.tar.gz
 
       - name: Run TruffleHog Scanner