Merge pull request 'Merge dev in testing: Erweitert Workflow-Skripte um Vulnverability und Dependency-Scanning' (#16) from dev into testing

Reviewed-on: #16

.gitea/workflows/main.yaml

@@ -19,6 +19,17 @@ jobs:
           toolchain: stable
           cache: false
 
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
       - name: Install Cross-Compilation Toolchains & Dependencies
         run: |
           sudo apt-get update

.gitea/workflows/renovate.yaml

@@ -9,7 +9,7 @@ jobs:
   renovate:
     name: Dependency-Updates prüfen & Pull Requests erstellen
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:43.279.0
+    container: ghcr.io/renovatebot/renovate:44.79.2
     steps:
       - name: Renovate ausführen
         run: renovate

.gitea/workflows/security-scan.yaml

@@ -15,32 +15,69 @@ jobs:
   security-scan:
     name: Trivy & OSV-Scanner
     runs-on: ubuntu-latest
+    env:
+      TRIVY_VERSION: "0.74.0"
+      OSV_SCANNER_VERSION: "2.5.1"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
-      - name: Run Trivy Scanner
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
-        uses: aquasecurity/trivy-action@v0.36.0
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Trivy-Binary
+        id: cache-trivy
+        uses: actions/cache@v6
         with:
-          scan-type: fs
+          path: ~/.local/bin/trivy
-          scan-ref: .
+          key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }}
-          scanners: vuln,secret,misconfig
+
-          severity: CRITICAL,HIGH
+      - name: Install Trivy
-          format: json
+        if: steps.cache-trivy.outputs.cache-hit != 'true'
-          output: trivy-results.json
+        run: |
-          exit-code: "0"
+          curl -fsSL -o trivy.tar.gz \
-          # github.token ist unter Gitea Actions der Gitea-Runner-Token, nicht gültig für
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-          # github.com. Leer lassen, damit der interne setup-trivy-Fallback (Klon von
+          tar -xzf trivy.tar.gz trivy
-          # aquasecurity/trivy zwecks Install-Skript, falls der Binary-Cache-Restore
+          chmod +x trivy
-          # fehlschlägt) anonym gegen das öffentliche GitHub-Repo läuft statt mit einem
+          mv trivy "$HOME/.local/bin/trivy"
-          # ungültigen Token einen 401 zu provozieren.
+          rm -f trivy.tar.gz
-          token-setup-trivy: ""
+
+      - name: Ermittle Cache-Datum für Trivy-DB
+        run: echo "CACHE_DATE=$(date -u +%Y-%m-%d)" >> "$GITHUB_ENV"
+
+      - name: Cache Trivy-Schwachstellen-Datenbank
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ runner.os }}-${{ env.CACHE_DATE }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
+
+      - name: Run Trivy Scanner
+        run: |
+          trivy fs \
+            --scanners vuln,secret,misconfig \
+            --severity CRITICAL,HIGH \
+            --format json \
+            --output trivy-results.json \
+            --exit-code 0 \
+            .
+
+      - name: Cache OSV-Scanner-Binary
+        id: cache-osv-scanner
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/osv-scanner
+          key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }}
 
       - name: Install OSV-Scanner
+        if: steps.cache-osv-scanner.outputs.cache-hit != 'true'
         run: |
-          curl -fsSL -o /usr/local/bin/osv-scanner \
+          curl -fsSL -o "$HOME/.local/bin/osv-scanner" \
-            "https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_amd64"
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
-          chmod +x /usr/local/bin/osv-scanner
+          chmod +x "$HOME/.local/bin/osv-scanner"
 
       - name: Run OSV-Scanner
         run: |

.gitea/workflows/testing.yaml

@@ -19,6 +19,17 @@ jobs:
           toolchain: stable
           cache: false
 
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
       - name: Install Cross-Compilation Toolchains & Dependencies
         run: |
           sudo apt-get update

.gitea/workflows/trufflehog-scan.yaml

@@ -4,26 +4,41 @@ on:
   push:
   pull_request:
   schedule:
-    - cron: "0 5 * * 1"
+    - cron: "0 6 * * 1"
   workflow_dispatch:
 
 jobs:
   trufflehog-scan:
     name: TruffleHog
     runs-on: ubuntu-latest
+    env:
+      TRUFFLEHOG_VERSION: "3.97.4"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache TruffleHog-Binary
+        id: cache-trufflehog
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trufflehog
+          key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }}
+
       - name: Install TruffleHog
+        if: steps.cache-trufflehog.outputs.cache-hit != 'true'
         run: |
           curl -fsSL -o trufflehog.tar.gz \
-            "https://github.com/trufflesecurity/trufflehog/releases/download/v3.97.4/trufflehog_3.97.4_linux_amd64.tar.gz"
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
           tar -xzf trufflehog.tar.gz trufflehog
           chmod +x trufflehog
-          sudo mv trufflehog /usr/local/bin/trufflehog
+          mv trufflehog "$HOME/.local/bin/trufflehog"
           rm trufflehog.tar.gz
 
       - name: Run TruffleHog Scanner

.idea/jsonSchemas.xml

@@ -20,6 +20,12 @@
                   <Item>
                     <option name="path" value=".gitea/workflows/renovate.yaml" />
                   </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/security-scan.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/trufflehog-scan.yaml" />
+                  </Item>
                 </list>
               </option>
             </SchemaInfo>

Cargo.lock

@@ -866,7 +866,7 @@ dependencies = [
 
 [[package]]
 name = "mirror-package"
-version = "1.0.2"
+version = "1.0.3"
 dependencies = [
  "anyhow",
  "clap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mirror-package"
-version = "1.0.2"
+version = "1.0.3"
 edition = "2024"
 authors = ['DragonSlayer_14']
 readme = "README.md"

renovate.json

@@ -3,14 +3,57 @@
   "extends": ["config:recommended"],
   "timezone": "Europe/Berlin",
   "schedule": ["before 6am on monday"],
+  "baseBranches": ["dev"],
   "packageRules": [
     {
-      "matchManagers": ["github-actions"],
+      "matchFileNames": [".gitea/workflows/**"],
-      "groupName": "Gitea Actions"
+      "groupName": "Gitea Actions",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    },
+    {
+      "matchManagers": ["cargo"],
+      "groupName": "Cargo Dependencies",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
     },
     {
       "matchManagers": ["dockerfile", "docker-compose"],
-      "groupName": "Docker-Images"
+      "groupName": "Docker-Images",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRIVY_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "aquasecurity/trivy",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "OSV_SCANNER_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "google/osv-scanner",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRUFFLEHOG_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "trufflesecurity/trufflehog",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
     }
   ]
 }