Fix: Versions-Tracking für Trivy/OSV-Scanner/TruffleHog & Renovate-Update

- Trivy 0.70.0 -> 0.74.0, Renovate-Container 43.279.0 -> 44.79.2
  (OSV-Scanner und TruffleHog waren bereits aktuell)
- OSV-Scanner- und TruffleHog-Versionen in Env-Vars ausgelagert
  (TruffleHog nutzte die Version zuvor zweimal im String, das
  verhinderte einen sauberen Regex-Match)
- Neuer customManagers-Regex-Block in renovate.json, da die drei
  Scanner-Versionen als curl-Strings in run-Blöcken stecken und vom
  github-actions-Manager (nur uses:/container:/services:) nicht
  erfasst werden

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kh9v73QApBwJj96w6A8R55

.gitea/workflows/renovate.yaml

@@ -9,7 +9,7 @@ jobs:
   renovate:
     name: Dependency-Updates prüfen & Pull Requests erstellen
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.279.0
+    container: ghcr.io/renovatebot/renovate:44.79.2
     steps:
       - name: Renovate ausführen
         run: renovate

.gitea/workflows/security-scan.yaml

@@ -21,7 +21,7 @@ jobs:
 
       - name: Install Trivy
         env:
-          TRIVY_VERSION: "0.70.0"
+          TRIVY_VERSION: "0.74.0"
         run: |
           curl -fsSL -o trivy.tar.gz \
             "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -41,9 +41,11 @@ jobs:
             .
 
       - name: Install OSV-Scanner
+        env:
+          OSV_SCANNER_VERSION: "2.5.1"
         run: |
           curl -fsSL -o /usr/local/bin/osv-scanner \
-            "https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_amd64"
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
           chmod +x /usr/local/bin/osv-scanner
 
       - name: Run OSV-Scanner

.gitea/workflows/trufflehog-scan.yaml

@@ -18,9 +18,11 @@ jobs:
           fetch-depth: 0
 
       - name: Install TruffleHog
+        env:
+          TRUFFLEHOG_VERSION: "3.97.4"
         run: |
           curl -fsSL -o trufflehog.tar.gz \
-            "https://github.com/trufflesecurity/trufflehog/releases/download/v3.97.4/trufflehog_3.97.4_linux_amd64.tar.gz"
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
           tar -xzf trufflehog.tar.gz trufflehog
           chmod +x trufflehog
           sudo mv trufflehog /usr/local/bin/trufflehog

renovate.json

@@ -12,5 +12,37 @@
       "matchManagers": ["dockerfile", "docker-compose"],
       "groupName": "Docker-Images"
     }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRIVY_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "aquasecurity/trivy",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "OSV_SCANNER_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "google/osv-scanner",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRUFFLEHOG_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "trufflesecurity/trufflehog",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    }
   ]
 }