diff --git a/.gitea/workflows/security-scan.yaml b/.gitea/workflows/security-scan.yaml index 54d3bea..a911f1a 100644 --- a/.gitea/workflows/security-scan.yaml +++ b/.gitea/workflows/security-scan.yaml @@ -22,6 +22,15 @@ jobs: - name: Checkout Repository uses: actions/checkout@v7 + - name: Architektur des Runners ermitteln + id: detect-arch + run: | + case "$(uname -m)" in + x86_64) echo "arch=amd64" >> "$GITHUB_OUTPUT" ;; + aarch64|arm64) echo "arch=arm64" >> "$GITHUB_OUTPUT" ;; + *) echo "Nicht unterstützte Architektur: $(uname -m)" >&2; exit 1 ;; + esac + - name: Lokales bin-Verzeichnis zum PATH hinzufügen run: | mkdir -p "$HOME/.local/bin" @@ -32,13 +41,17 @@ jobs: uses: actions/cache@v6 with: path: ~/.local/bin/trivy - key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }} + key: trivy-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.TRIVY_VERSION }} - name: Install Trivy if: steps.cache-trivy.outputs.cache-hit != 'true' run: | + case "${{ steps.detect-arch.outputs.arch }}" in + amd64) TRIVY_ARCH="64bit" ;; + arm64) TRIVY_ARCH="ARM64" ;; + esac curl -fsSL -o trivy.tar.gz \ - "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" + "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz" tar -xzf trivy.tar.gz trivy chmod +x trivy mv trivy "$HOME/.local/bin/trivy" @@ -70,13 +83,13 @@ jobs: uses: actions/cache@v6 with: path: ~/.local/bin/osv-scanner - key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }} + key: osv-scanner-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.OSV_SCANNER_VERSION }} - name: Install OSV-Scanner if: steps.cache-osv-scanner.outputs.cache-hit != 'true' run: | curl -fsSL -o "$HOME/.local/bin/osv-scanner" \ - "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64" + "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_${{ steps.detect-arch.outputs.arch }}" chmod +x "$HOME/.local/bin/osv-scanner" - name: Run OSV-Scanner diff --git a/.gitea/workflows/trufflehog-scan.yaml b/.gitea/workflows/trufflehog-scan.yaml index b059507..99fd335 100644 --- a/.gitea/workflows/trufflehog-scan.yaml +++ b/.gitea/workflows/trufflehog-scan.yaml @@ -19,6 +19,15 @@ jobs: with: fetch-depth: 0 + - name: Architektur des Runners ermitteln + id: detect-arch + run: | + case "$(uname -m)" in + x86_64) echo "arch=amd64" >> "$GITHUB_OUTPUT" ;; + aarch64|arm64) echo "arch=arm64" >> "$GITHUB_OUTPUT" ;; + *) echo "Nicht unterstützte Architektur: $(uname -m)" >&2; exit 1 ;; + esac + - name: Lokales bin-Verzeichnis zum PATH hinzufügen run: | mkdir -p "$HOME/.local/bin" @@ -29,13 +38,13 @@ jobs: uses: actions/cache@v6 with: path: ~/.local/bin/trufflehog - key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }} + key: trufflehog-bin-${{ runner.os }}-${{ steps.detect-arch.outputs.arch }}-${{ env.TRUFFLEHOG_VERSION }} - name: Install TruffleHog if: steps.cache-trufflehog.outputs.cache-hit != 'true' run: | curl -fsSL -o trufflehog.tar.gz \ - "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz" + "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_${{ steps.detect-arch.outputs.arch }}.tar.gz" tar -xzf trufflehog.tar.gz trufflehog chmod +x trufflehog mv trufflehog "$HOME/.local/bin/trufflehog"