From ea1530680c97198bf2357dc5f705ca7bba248bbf Mon Sep 17 00:00:00 2001 From: DragonSlayer_14 Date: Thu, 10 Sep 2026 20:03:36 +0200 Subject: [PATCH] CI: actions/cache@v6 fuer Cargo- und Scanner-Binaries ergaenzt - main.yaml/testing.yaml: Cargo-Registry & target/ ueber Cargo.lock-Hash gecacht (groesster Zeitfresser bei 3 Cross-Compile-Targets) - security-scan.yaml: Trivy- und OSV-Scanner-Binary versionsbasiert gecacht, zusaetzlich Trivy-Vulnerability-DB tagesbasiert gecacht (sonst voller OCI-Download bei jedem Lauf) - trufflehog-scan.yaml: TruffleHog-Binary versionsbasiert gecacht Installation aller drei Scanner-Binaries von sudo-basiertem /usr/local/bin auf $HOME/.local/bin umgestellt, da actions/cache sonst ohne sudo nicht zuverlaessig in root-Verzeichnisse restoren kann. TRIVY_VERSION/OSV_SCANNER_VERSION/TRUFFLEHOG_VERSION dafuer auf Job-Ebene verschoben (Cache-Steps brauchen sie fuer den Cache-Key); die Renovate-customManagers-Regexe matchen weiterhin, da sie auf dem rohen Dateitext arbeiten statt auf der YAML-Struktur. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Kh9v73QApBwJj96w6A8R55 --- .gitea/workflows/main.yaml | 11 +++++++ .gitea/workflows/security-scan.yaml | 45 ++++++++++++++++++++++----- .gitea/workflows/testing.yaml | 11 +++++++ .gitea/workflows/trufflehog-scan.yaml | 19 +++++++++-- 4 files changed, 76 insertions(+), 10 deletions(-) diff --git a/.gitea/workflows/main.yaml b/.gitea/workflows/main.yaml index c6434ec..c63f78b 100644 --- a/.gitea/workflows/main.yaml +++ b/.gitea/workflows/main.yaml @@ -19,6 +19,17 @@ jobs: toolchain: stable cache: false + - name: Cache Cargo-Abhängigkeiten & Build-Artefakte + uses: actions/cache@v6 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }} + restore-keys: | + cargo-${{ runner.os }}- + - name: Install Cross-Compilation Toolchains & Dependencies run: | sudo apt-get update diff --git a/.gitea/workflows/security-scan.yaml b/.gitea/workflows/security-scan.yaml index 5a8adf5..75df4b3 100644 --- a/.gitea/workflows/security-scan.yaml +++ b/.gitea/workflows/security-scan.yaml @@ -15,21 +15,46 @@ jobs: security-scan: name: Trivy & OSV-Scanner runs-on: ubuntu-latest + env: + TRIVY_VERSION: "0.74.0" + OSV_SCANNER_VERSION: "2.5.1" steps: - name: Checkout Repository uses: actions/checkout@v7 + - name: Lokales bin-Verzeichnis zum PATH hinzufügen + run: | + mkdir -p "$HOME/.local/bin" + echo "$HOME/.local/bin" >> "$GITHUB_PATH" + + - name: Cache Trivy-Binary + id: cache-trivy + uses: actions/cache@v6 + with: + path: ~/.local/bin/trivy + key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }} + - name: Install Trivy - env: - TRIVY_VERSION: "0.74.0" + if: steps.cache-trivy.outputs.cache-hit != 'true' run: | curl -fsSL -o trivy.tar.gz \ "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" tar -xzf trivy.tar.gz trivy chmod +x trivy - sudo mv trivy /usr/local/bin/trivy + mv trivy "$HOME/.local/bin/trivy" rm -f trivy.tar.gz + - name: Ermittle Cache-Datum für Trivy-DB + run: echo "CACHE_DATE=$(date -u +%Y-%m-%d)" >> "$GITHUB_ENV" + + - name: Cache Trivy-Schwachstellen-Datenbank + uses: actions/cache@v6 + with: + path: ~/.cache/trivy + key: trivy-db-${{ runner.os }}-${{ env.CACHE_DATE }} + restore-keys: | + trivy-db-${{ runner.os }}- + - name: Run Trivy Scanner run: | trivy fs \ @@ -40,13 +65,19 @@ jobs: --exit-code 0 \ . + - name: Cache OSV-Scanner-Binary + id: cache-osv-scanner + uses: actions/cache@v6 + with: + path: ~/.local/bin/osv-scanner + key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }} + - name: Install OSV-Scanner - env: - OSV_SCANNER_VERSION: "2.5.1" + if: steps.cache-osv-scanner.outputs.cache-hit != 'true' run: | - curl -fsSL -o /usr/local/bin/osv-scanner \ + curl -fsSL -o "$HOME/.local/bin/osv-scanner" \ "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64" - chmod +x /usr/local/bin/osv-scanner + chmod +x "$HOME/.local/bin/osv-scanner" - name: Run OSV-Scanner run: | diff --git a/.gitea/workflows/testing.yaml b/.gitea/workflows/testing.yaml index 47047aa..a818c08 100644 --- a/.gitea/workflows/testing.yaml +++ b/.gitea/workflows/testing.yaml @@ -19,6 +19,17 @@ jobs: toolchain: stable cache: false + - name: Cache Cargo-Abhängigkeiten & Build-Artefakte + uses: actions/cache@v6 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }} + restore-keys: | + cargo-${{ runner.os }}- + - name: Install Cross-Compilation Toolchains & Dependencies run: | sudo apt-get update diff --git a/.gitea/workflows/trufflehog-scan.yaml b/.gitea/workflows/trufflehog-scan.yaml index d63bbb9..5e4fcb6 100644 --- a/.gitea/workflows/trufflehog-scan.yaml +++ b/.gitea/workflows/trufflehog-scan.yaml @@ -11,21 +11,34 @@ jobs: trufflehog-scan: name: TruffleHog runs-on: ubuntu-latest + env: + TRUFFLEHOG_VERSION: "3.97.4" steps: - name: Checkout Repository uses: actions/checkout@v7 with: fetch-depth: 0 + - name: Lokales bin-Verzeichnis zum PATH hinzufügen + run: | + mkdir -p "$HOME/.local/bin" + echo "$HOME/.local/bin" >> "$GITHUB_PATH" + + - name: Cache TruffleHog-Binary + id: cache-trufflehog + uses: actions/cache@v6 + with: + path: ~/.local/bin/trufflehog + key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }} + - name: Install TruffleHog - env: - TRUFFLEHOG_VERSION: "3.97.4" + if: steps.cache-trufflehog.outputs.cache-hit != 'true' run: | curl -fsSL -o trufflehog.tar.gz \ "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz" tar -xzf trufflehog.tar.gz trufflehog chmod +x trufflehog - sudo mv trufflehog /usr/local/bin/trufflehog + mv trufflehog "$HOME/.local/bin/trufflehog" rm trufflehog.tar.gz - name: Run TruffleHog Scanner