Revert: Trivy-Workflow wieder auf trivy-action ohne Workarounds

Manueller Install und token-setup-trivy-Override haben unter dem
Gitea act_runner beide nicht wie erwartet funktioniert. Zurück auf
den ursprünglichen Aufbau mit trivy-action@v0.36.0 pur.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FKMjR9pBxshZYZdhKyT5Ky

.gitea/workflows/renovate.yaml

@@ -0,0 +1,25 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 4 * * 1"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    name: Dependency-Updates prüfen & Pull Requests erstellen
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:43.279.0
+    steps:
+      - name: Renovate ausführen
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ gitea.server_url || github.server_url }}/api/v1/
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_REPOSITORIES: ${{ gitea.repository || github.repository }}
+          RENOVATE_AUTODISCOVER: "false"
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@creative-dragonslayer.de>"
+          RENOVATE_HOST_RULES: >-
+            [{"hostType":"cargo","matchHost":"gitea.creative-dragonslayer.de","token":"${{ secrets.RENOVATE_TOKEN }}"}]
+          LOG_LEVEL: info

.gitea/workflows/security-scan.yaml

@@ -0,0 +1,52 @@
+name: Security Scans
+
+on:
+  push:
+    branches:
+      - main
+      - testing
+      - dev
+  pull_request:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    name: Trivy & OSV-Scanner
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Run Trivy Scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln,secret,misconfig
+          severity: CRITICAL,HIGH
+          format: json
+          output: trivy-results.json
+          exit-code: "0"
+
+      - name: Install OSV-Scanner
+        run: |
+          curl -fsSL -o /usr/local/bin/osv-scanner \
+            "https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_amd64"
+          chmod +x /usr/local/bin/osv-scanner
+
+      - name: Run OSV-Scanner
+        run: |
+          set +e
+          osv-scanner scan source --recursive --format json --output-file osv-results.json .
+          echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
+
+      - name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.SECURITY_TOKEN }}
+          RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
+        run: |
+          python3 scripts/report-security-issue.py trivy-results.json osv-results.json

.gitea/workflows/trufflehog-scan.yaml

@@ -0,0 +1,44 @@
+name: TruffleHog Secret Scan
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+jobs:
+  trufflehog-scan:
+    name: TruffleHog
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install TruffleHog
+        run: |
+          curl -fsSL -o trufflehog.tar.gz \
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v3.97.4/trufflehog_3.97.4_linux_amd64.tar.gz"
+          tar -xzf trufflehog.tar.gz trufflehog
+          chmod +x trufflehog
+          sudo mv trufflehog /usr/local/bin/trufflehog
+          rm trufflehog.tar.gz
+
+      - name: Run TruffleHog Scanner
+        run: |
+          set +e
+          trufflehog git file://. --results=verified,unknown --fail --json > trufflehog-results.json
+          echo "TRUFFLEHOG_EXIT=$?" >> "$GITHUB_ENV"
+
+      - name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.SECURITY_TOKEN }}
+          RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
+          ISSUE_TITLE: "Security-Scan: TruffleHog Secrets"
+          ISSUE_LABEL: "security-scan-trufflehog"
+        run: |
+          python3 scripts/report-security-issue.py "" "" trufflehog-results.json

.gitignore

@@ -109,3 +109,4 @@ fabric.properties
 # Built Visual Studio Code Extensions
 *.vsix
 
+.junie/plans

.idea/jsonSchemas.xml

@@ -17,6 +17,15 @@
                   <Item>
                     <option name="path" value=".gitea/workflows/testing.yaml" />
                   </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/renovate.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/security-scan.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/trufflehog-scan.yaml" />
+                  </Item>
                 </list>
               </option>
             </SchemaInfo>

.idea/runConfigurations/Run.xml

@@ -0,0 +1,20 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Run" type="CargoCommandRunConfiguration" factoryName="Cargo Command" nameIsGenerated="true">
+    <option name="buildProfileId" value="dev" />
+    <option name="command" value="run" />
+    <option name="workingDirectory" value="file://$PROJECT_DIR$" />
+    <envs />
+    <option name="emulateTerminal" value="true" />
+    <option name="channel" value="DEFAULT" />
+    <option name="requiredFeatures" value="true" />
+    <option name="allFeatures" value="false" />
+    <option name="withSudo" value="false" />
+    <option name="buildTarget" value="REMOTE" />
+    <option name="backtrace" value="SHORT" />
+    <option name="isRedirectInput" value="false" />
+    <option name="redirectInputPath" value="" />
+    <method v="2">
+      <option name="CARGO.BUILD_TASK_PROVIDER" enabled="true" />
+    </method>
+  </configuration>
+</component>

.idea/rust-template.iml

@@ -4,6 +4,7 @@
     <content url="file://$MODULE_DIR$">
       <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/tests" isTestSource="true" />
+      <excludeFolder url="file://$MODULE_DIR$/.junie/plans" />
       <excludeFolder url="file://$MODULE_DIR$/target" />
     </content>
     <orderEntry type="inheritedJdk" />

Cargo.lock

@@ -874,7 +874,6 @@ dependencies = [
  "logger-ctdra",
  "reqwest",
  "serde",
- "serde_json",
  "tokio",
 ]
 

Cargo.toml

@@ -15,7 +15,6 @@ clap = { version = "4.6.6", features = ["derive", "env"] }
 reqwest = { version = "0.13.4", features = ["json", "stream"] }
 tokio = { version = "1.53.1", features = ["full"] }
 serde = { version = "1.0.229", features = ["derive"] }
-serde_json = "1.0.151"
 anyhow = "1.0.104"
 
 [profile.release]

renovate.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "Europe/Berlin",
+  "schedule": ["before 6am on monday"],
+  "packageRules": [
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "Gitea Actions"
+    },
+    {
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "groupName": "Docker-Images"
+    }
+  ]
+}

scripts/report-security-issue.py

@@ -0,0 +1,308 @@
+#!/usr/bin/env python3
+"""Erstellt oder kommentiert ein Gitea-Issue mit den Ergebnissen der Security-Scans.
+
+Sucht ein offenes Issue mit dem Label ISSUE_LABEL (Standard: "security-scan").
+Existiert eines, wird der aktuelle Scan-Stand als neuer Kommentar angehängt
+(die Historie bleibt erhalten). Existiert keines (z.B. weil das letzte
+geschlossen wurde), wird ein neues Issue erstellt. Gibt es keine Funde mehr,
+wird ein offenes Issue nur kommentiert, nicht geschlossen.
+
+Titel und Label lassen sich per Umgebungsvariable ISSUE_TITLE / ISSUE_LABEL
+überschreiben, damit z.B. TruffleHog-Funde in ein eigenes Issue laufen statt
+in das gemeinsame Trivy/OSV-Issue.
+"""
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+LABEL_NAME = os.environ.get("ISSUE_LABEL", "security-scan")
+LABEL_COLOR = "#b60205"
+ISSUE_TITLE = os.environ.get("ISSUE_TITLE", "Security-Scan: Offene Schwachstellen")
+
+SEVERITY_ORDER = {
+    "VERIFIED": -1,
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 3,
+    "UNKNOWN": 4,
+    "UNVERIFIED": 6,
+}
+
+
+def api(method, path, token, gitea_url, data=None):
+    url = f"{gitea_url}/api/v1{path}"
+    body = json.dumps(data).encode() if data is not None else None
+    req = urllib.request.Request(url, data=body, method=method)
+    req.add_header("Authorization", f"token {token}")
+    req.add_header("Content-Type", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            raw = resp.read()
+            return json.loads(raw) if raw else None
+    except urllib.error.HTTPError as e:
+        print(f"Gitea API Fehler ({method} {path}): {e.code} {e.read().decode()}", file=sys.stderr)
+        raise
+
+
+def make_finding(source, id, severity, package, installed="-", fixed="-", target="-"):
+    return {
+        "source": source,
+        "id": id,
+        "severity": severity,
+        "package": package,
+        "installed": installed,
+        "fixed": fixed,
+        "target": target,
+    }
+
+
+def cvss_score_to_severity(score):
+    try:
+        score = float(score)
+    except (TypeError, ValueError):
+        return "UNKNOWN"
+    if score >= 9.0:
+        return "CRITICAL"
+    if score >= 7.0:
+        return "HIGH"
+    if score >= 4.0:
+        return "MEDIUM"
+    if score > 0.0:
+        return "LOW"
+    return "UNKNOWN"
+
+
+def load_trivy(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        data = json.load(f)
+    for result in data.get("Results", []) or []:
+        target = result.get("Target", "?")
+        for vuln in result.get("Vulnerabilities", []) or []:
+            findings.append(make_finding(
+                "Trivy",
+                vuln.get("VulnerabilityID", "?"),
+                vuln.get("Severity", "UNKNOWN"),
+                vuln.get("PkgName", "?"),
+                installed=vuln.get("InstalledVersion", "?"),
+                fixed=vuln.get("FixedVersion") or "-",
+                target=target,
+            ))
+        for misc in result.get("Misconfigurations", []) or []:
+            findings.append(make_finding(
+                "Trivy (Misconfig)",
+                misc.get("ID", "?"),
+                misc.get("Severity", "UNKNOWN"),
+                misc.get("Title", "?"),
+                target=target,
+            ))
+        for secret in result.get("Secrets", []) or []:
+            findings.append(make_finding(
+                "Trivy (Secret)",
+                secret.get("RuleID", "?"),
+                secret.get("Severity", "UNKNOWN"),
+                secret.get("Title", "?"),
+                target=target,
+            ))
+    return findings
+
+
+def load_osv(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        data = json.load(f)
+    for result in data.get("results", []) or []:
+        source = (result.get("source") or {}).get("path", "?")
+        for pkg in result.get("packages", []) or []:
+            info = pkg.get("package", {})
+            pkg_name = f"{info.get('name', '?')} ({info.get('ecosystem', '?')})"
+            severity_by_id = {}
+            for group in pkg.get("groups", []) or []:
+                label = cvss_score_to_severity(group.get("max_severity"))
+                for vuln_id in group.get("ids", []) or []:
+                    severity_by_id[vuln_id] = label
+            for vuln in pkg.get("vulnerabilities", []) or []:
+                vuln_id = vuln.get("id", "?")
+                findings.append(make_finding(
+                    "OSV-Scanner",
+                    vuln_id,
+                    severity_by_id.get(vuln_id, "UNKNOWN"),
+                    pkg_name,
+                    installed=info.get("version", "?"),
+                    target=source,
+                ))
+    return findings
+
+
+def load_trufflehog(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        for line in f:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                entry = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            git_meta = ((entry.get("SourceMetadata") or {}).get("Data") or {}).get("Git") or {}
+            findings.append(make_finding(
+                "TruffleHog",
+                entry.get("DetectorName", "?"),
+                "VERIFIED" if entry.get("Verified") else "UNVERIFIED",
+                git_meta.get("file", "?"),
+                target=git_meta.get("commit", "-"),
+            ))
+    return findings
+
+
+def sort_findings(findings):
+    return sorted(findings, key=lambda f: (SEVERITY_ORDER.get(f["severity"], 9), f["id"]))
+
+
+def print_summary(findings):
+    if not findings:
+        print("Keine Funde.")
+        return
+    widths = {
+        key: max(len(key), *(len(str(f[key])) for f in findings))
+        for key in ("source", "id", "severity", "package", "installed", "fixed", "target")
+    }
+    header = ("source", "id", "severity", "package", "installed", "fixed", "target")
+    row_fmt = "  ".join(f"{{:{widths[k]}}}" for k in header)
+    print(row_fmt.format(*header))
+    print(row_fmt.format(*("-" * widths[k] for k in header)))
+    for f in findings:
+        print(row_fmt.format(*(str(f[k]) for k in header)))
+
+
+TRUFFLEHOG_GUIDANCE = """### Vorgehen bei gefundenen Secrets
+
+1. **Sofort rotieren/widerrufen**: Das betroffene Secret (Token, Passwort, Schlüssel) beim jeweiligen Dienst ungültig machen und durch ein neues ersetzen. Ein einmal committetes Secret gilt als kompromittiert, auch wenn es später aus der Historie entfernt wird.
+2. **Ursache beheben**: Neues Secret nur noch über Umgebungsvariablen/Secrets-Store einbinden, nicht erneut hart codieren.
+3. **Historie bereinigen (optional, manuell, erst nach Schritt 1)**: Mit `git filter-repo` oder BFG Repo-Cleaner den Commit-Inhalt entfernen, danach `git push --force` in Absprache mit allen Mitwirkenden – bestehende Clones/Forks werden dadurch ungültig.
+4. **Issue schließen**, sobald rotiert wurde. TruffleHog findet das alte Secret ggf. weiterhin in der Historie – nach der Rotation ist das unkritisch.
+
+> Der Wert des Secrets selbst wird hier bewusst nicht ausgegeben, auch nicht gekürzt – nur Detector, Datei und Commit. Fund lässt sich über "Ziel" (Commit-Hash) und "Paket" (Dateipfad) lokalisieren."""
+
+
+def escape_md_cell(value):
+    return str(value).replace("|", "\\|").replace("\r", " ").replace("\n", " ")
+
+
+def build_report(findings, run_url):
+    lines = [
+        "Automatisch erstellt vom Security-Scan-Workflow.",
+        f"Lauf: {run_url}" if run_url else "",
+        "",
+        "| Quelle | ID | Schweregrad | Paket | Installiert | Fix | Ziel |",
+        "|---|---|---|---|---|---|---|",
+    ]
+    for f in findings:
+        cells = (f["source"], f["id"], f["severity"], f["package"], f["installed"], f["fixed"], f["target"])
+        lines.append("| " + " | ".join(escape_md_cell(c) for c in cells) + " |")
+    if any(f["source"] == "TruffleHog" for f in findings):
+        lines.append("")
+        lines.append(TRUFFLEHOG_GUIDANCE)
+    return "\n".join(lines)
+
+
+def ensure_label(token, gitea_url, repo):
+    page = 1
+    while True:
+        labels = api("GET", f"/repos/{repo}/labels?limit=50&page={page}", token, gitea_url) or []
+        for label in labels:
+            if label.get("name") == LABEL_NAME:
+                return label["id"]
+        if len(labels) < 50:
+            break
+        page += 1
+    created = api("POST", f"/repos/{repo}/labels", token, gitea_url, {
+        "name": LABEL_NAME,
+        "color": LABEL_COLOR,
+        "description": "Automatisch verwaltet vom Security-Scan-Workflow",
+    })
+    return created["id"]
+
+
+def find_open_issue(token, gitea_url, repo):
+    issues = api(
+        "GET",
+        f"/repos/{repo}/issues?state=open&type=issues&labels={LABEL_NAME}",
+        token,
+        gitea_url,
+    ) or []
+    for issue in issues:
+        if issue.get("title") == ISSUE_TITLE:
+            return issue
+    return None
+
+
+def main():
+    trivy_path = sys.argv[1] if len(sys.argv) > 1 else None
+    osv_path = sys.argv[2] if len(sys.argv) > 2 else None
+    trufflehog_path = sys.argv[3] if len(sys.argv) > 3 else None
+
+    gitea_url = os.environ["GITEA_URL"].rstrip("/")
+    repo = os.environ["REPO"]
+    token = os.environ["TOKEN"]
+    run_url = os.environ.get("RUN_URL", "")
+    osv_exit = int(os.environ.get("OSV_EXIT", "0"))
+    trufflehog_exit = int(os.environ.get("TRUFFLEHOG_EXIT", "0"))
+
+    findings = sort_findings(load_trivy(trivy_path) + load_osv(osv_path) + load_trufflehog(trufflehog_path))
+    print_summary(findings)
+
+    open_issue = find_open_issue(token, gitea_url, repo)
+
+    if findings:
+        report = build_report(findings, run_url)
+        if open_issue:
+            print(f"Kommentiere bestehendes Issue #{open_issue['number']} mit {len(findings)} Fund(en).")
+            api("POST", f"/repos/{repo}/issues/{open_issue['number']}/comments", token, gitea_url, {"body": report})
+        else:
+            label_id = ensure_label(token, gitea_url, repo)
+            print(f"Erstelle neues Issue mit {len(findings)} Fund(en).")
+            api("POST", f"/repos/{repo}/issues", token, gitea_url, {
+                "title": ISSUE_TITLE,
+                "body": report,
+                "labels": [label_id],
+            })
+    elif open_issue:
+        print(f"Keine aktuellen Funde mehr. Kommentiere Issue #{open_issue['number']}.")
+        api("POST", f"/repos/{repo}/issues/{open_issue['number']}/comments", token, gitea_url, {
+            "body": f"Aktueller Scan hat keine offenen Schwachstellen mehr gefunden.\n\n{run_url}".strip(),
+        })
+    else:
+        print("Keine Funde und kein offenes Issue vorhanden.")
+
+    osv_ok_exits = {0, 1}
+    trufflehog_ok_exits = {0, 183}
+    if osv_exit not in osv_ok_exits:
+        print(f"WARNUNG: osv-scanner beendete sich mit unerwartetem Exit-Code {osv_exit} - Scan evtl. unvollständig.", file=sys.stderr)
+    if trufflehog_exit not in trufflehog_ok_exits:
+        print(f"WARNUNG: trufflehog beendete sich mit unerwartetem Exit-Code {trufflehog_exit} - Scan evtl. unvollständig.", file=sys.stderr)
+
+    has_trivy_findings = any(f["source"].startswith("Trivy") for f in findings)
+    if (
+        has_trivy_findings
+        or osv_exit == 1
+        or trufflehog_exit == 183
+        or osv_exit not in osv_ok_exits
+        or trufflehog_exit not in trufflehog_ok_exits
+    ):
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()