From f1c261ebddc00b25caffd2622d5f7da51d4c2a40 Mon Sep 17 00:00:00 2001
From: DragonSlayer_14 <dragonslayer14@murena.io>
Date: Thu, 10 Sep 2026 19:38:49 +0200
Subject: [PATCH] =?UTF-8?q?Fix:=20Versions-Tracking=20f=C3=BCr=20Trivy/OSV?=
 =?UTF-8?q?-Scanner/TruffleHog=20&=20Renovate-Update?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Trivy 0.70.0 -> 0.74.0, Renovate-Container 43.279.0 -> 44.79.2
  (OSV-Scanner und TruffleHog waren bereits aktuell)
- OSV-Scanner- und TruffleHog-Versionen in Env-Vars ausgelagert
  (TruffleHog nutzte die Version zuvor zweimal im String, das
  verhinderte einen sauberen Regex-Match)
- Neuer customManagers-Regex-Block in renovate.json, da die drei
  Scanner-Versionen als curl-Strings in run-Blöcken stecken und vom
  github-actions-Manager (nur uses:/container:/services:) nicht
  erfasst werden

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kh9v73QApBwJj96w6A8R55
---
 .gitea/workflows/renovate.yaml        |  2 +-
 .gitea/workflows/security-scan.yaml   |  6 +++--
 .gitea/workflows/trufflehog-scan.yaml |  4 +++-
 renovate.json                         | 32 +++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/renovate.yaml b/.gitea/workflows/renovate.yaml
index fee0b8e..9fd8195 100644
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -9,7 +9,7 @@ jobs:
   renovate:
     name: Dependency-Updates prüfen & Pull Requests erstellen
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.279.0
+    container: ghcr.io/renovatebot/renovate:44.79.2
     steps:
       - name: Renovate ausführen
         run: renovate
diff --git a/.gitea/workflows/security-scan.yaml b/.gitea/workflows/security-scan.yaml
index 2084812..5a8adf5 100644
--- a/.gitea/workflows/security-scan.yaml
+++ b/.gitea/workflows/security-scan.yaml
@@ -21,7 +21,7 @@ jobs:
 
       - name: Install Trivy
         env:
-          TRIVY_VERSION: "0.70.0"
+          TRIVY_VERSION: "0.74.0"
         run: |
           curl -fsSL -o trivy.tar.gz \
             "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -41,9 +41,11 @@ jobs:
             .
 
       - name: Install OSV-Scanner
+        env:
+          OSV_SCANNER_VERSION: "2.5.1"
         run: |
           curl -fsSL -o /usr/local/bin/osv-scanner \
-            "https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_amd64"
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
           chmod +x /usr/local/bin/osv-scanner
 
       - name: Run OSV-Scanner
diff --git a/.gitea/workflows/trufflehog-scan.yaml b/.gitea/workflows/trufflehog-scan.yaml
index d374757..d6b917e 100644
--- a/.gitea/workflows/trufflehog-scan.yaml
+++ b/.gitea/workflows/trufflehog-scan.yaml
@@ -18,9 +18,11 @@ jobs:
           fetch-depth: 0
 
       - name: Install TruffleHog
+        env:
+          TRUFFLEHOG_VERSION: "3.97.4"
         run: |
           curl -fsSL -o trufflehog.tar.gz \
-            "https://github.com/trufflesecurity/trufflehog/releases/download/v3.97.4/trufflehog_3.97.4_linux_amd64.tar.gz"
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
           tar -xzf trufflehog.tar.gz trufflehog
           chmod +x trufflehog
           sudo mv trufflehog /usr/local/bin/trufflehog
diff --git a/renovate.json b/renovate.json
index 30693da..efd7ab7 100644
--- a/renovate.json
+++ b/renovate.json
@@ -12,5 +12,37 @@
       "matchManagers": ["dockerfile", "docker-compose"],
       "groupName": "Docker-Images"
     }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRIVY_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "aquasecurity/trivy",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "OSV_SCANNER_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "google/osv-scanner",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRUFFLEHOG_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "trufflesecurity/trufflehog",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    }
   ]
 }