dandri/MeshChatX
1
0
Fork 0
mirror of https://git.quad4.io/RNS-Things/MeshChatX.git synced 2026-09-16 12:43:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move to scan.yml security scanning workflow and integrate Trivy better

Browse Source
This commit is contained in:
Sudo-Ivan
2026-01-16 09:02:04 -06:00
parent 8e47de38ad
commit 3fbaab9136
3 changed files with 45 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/docker.yml
+16 -10
View File
@@ -46,6 +46,14 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
- name: Download Trivy
run: |
curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
- name: Trivy FS scan
run: trivy fs --exit-code 1 .
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: https://git.quad4.io/actions/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
@@ -70,11 +78,6 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Download Trivy
run: |
curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
- name: Scan Docker image
run: |
# Extract the first tag from the multi-line tags output
@@ -109,6 +112,14 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
- name: Download Trivy
run: |
curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
- name: Trivy FS scan
run: trivy fs --exit-code 1 .
- name: Extract DEV metadata (tags, labels) for Docker
id: meta-dev
uses: https://git.quad4.io/actions/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
@@ -130,11 +141,6 @@ jobs:
tags: ${{ steps.meta-dev.outputs.tags }}
labels: ${{ steps.meta-dev.outputs.labels }}
- name: Download Trivy
run: |
curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
- name: Scan Docker image (dev)
run: |
# Extract the first tag from the multi-line tags output
.gitea/workflows/osv-scheduled.yml
-20
View File
@@ -1,20 +0,0 @@
name: OSV-Scanner Scheduled Scan
on:
schedule:
- cron: "30 12 * * 1"
push:
branches: [master]
permissions:
contents: read
jobs:
scan-scheduled:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: https://git.quad4.io/actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- name: OSV scan
run: bash scripts/osv_scan.sh
.gitea/workflows/scan.yml
+29
View File
@@ -0,0 +1,29 @@
name: Security Scans
on:
schedule:
- cron: "30 12 * * 1"
push:
branches: [master]
workflow_dispatch:
permissions:
contents: read
jobs:
scan:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: https://git.quad4.io/actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- name: OSV scan
run: bash scripts/osv_scan.sh
- name: Download Trivy
run: |
curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/917e0e52b2f663cbbe13e63b7176262e248265ae/trivy_0.68.2_Linux-64bit.deb
sudo dpkg -i /tmp/trivy.deb || sudo apt-get install -f -y
- name: Trivy FS scan
run: trivy fs --exit-code 1 .