From 6ea4b37cb9f20470c160ffe9f64d9209d3e07049 Mon Sep 17 00:00:00 2001
From: Ivan <ivan@quad4.io>
Date: Mon, 27 Apr 2026 11:14:42 -0500
Subject: [PATCH] chore(workflows): add Trivy setup and update steps in build
 and security scan workflows

---
 .github/workflows/build-linux-release.yml |  6 +++++
 .github/workflows/build-release.yml       | 30 +++++++++++++++++++++++
 .github/workflows/security-scan.yml       |  5 ++++
 3 files changed, 41 insertions(+)

diff --git a/.github/workflows/build-linux-release.yml b/.github/workflows/build-linux-release.yml
index 40e5a2b..12e7df2 100644
--- a/.github/workflows/build-linux-release.yml
+++ b/.github/workflows/build-linux-release.yml
@@ -37,6 +37,8 @@ env:
     POETRY_VERSION: "2.3.4"
     PNPM_VERSION: "10.33.0"
     COSIGN_VERSION: "3.0.6"
+    TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
+    TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
 
 jobs:
     frontend:
@@ -116,6 +118,9 @@ jobs:
             - name: Setup Task
               run: sh scripts/ci/setup-task.sh
 
+            - name: Apt update (for Trivy .deb)
+              run: sh scripts/ci/exec-priv.sh apt-get update -qq
+
             - name: Setup Trivy
               run: sh scripts/ci/setup-trivy.sh
 
@@ -138,6 +143,7 @@ jobs:
                   GITHUB_RUN_ID: ${{ github.run_id }}
                   GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
                   GITHUB_WORKFLOW: ${{ github.workflow }}
+                  GITHUB_WORKFLOW_FILE: build-linux-release.yml
                   COSIGN_VERSION: ${{ env.COSIGN_VERSION }}
               run: |
                   set -eu
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 9b40c7a..48516f3 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -36,6 +36,7 @@ env:
     NODE_VERSION: "24"
     POETRY_VERSION: "2.3.4"
     PNPM_VERSION: "10.32.1"
+    COSIGN_VERSION: "3.0.6"
 
 jobs:
     frontend:
@@ -199,6 +200,9 @@ jobs:
         permissions:
             contents: write
         steps:
+            - name: Checkout
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
             - name: Download Windows dist
               uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
               with:
@@ -217,6 +221,32 @@ jobs:
                   name: ${{ needs.slsa-provenance-desktop.outputs.provenance-name }}
                   path: upload
 
+            - name: SLSA cosign bundles (desktop assets)
+              env:
+                  COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+                  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+                  GITHUB_SERVER_URL: ${{ github.server_url }}
+                  GITHUB_REPOSITORY: ${{ github.repository }}
+                  GITHUB_SHA: ${{ github.sha }}
+                  GITHUB_REF: ${{ github.ref }}
+                  GITHUB_RUN_ID: ${{ github.run_id }}
+                  GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+                  GITHUB_WORKFLOW: ${{ github.workflow }}
+                  GITHUB_WORKFLOW_FILE: build-release.yml
+                  COSIGN_VERSION: ${{ env.COSIGN_VERSION }}
+              run: |
+                  set -eu
+                  if [ -z "${COSIGN_PRIVATE_KEY:-}" ]; then
+                    echo "Skipping cosign attestations (no COSIGN_PRIVATE_KEY)."
+                    exit 0
+                  fi
+                  sh scripts/ci/setup-cosign.sh "${COSIGN_VERSION}"
+                  printf '%s\n' "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key
+                  chmod 600 /tmp/cosign.key
+                  export COSIGN_KEY_PATH=/tmp/cosign.key
+                  sh scripts/ci/attest-release-assets.sh upload
+                  rm -f /tmp/cosign.key
+
             - name: Upload to draft release
               env:
                   GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 82b657a..ef62a6b 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,6 +32,8 @@ env:
     NODE_VERSION: "24"
     POETRY_VERSION: "2.3.4"
     PNPM_VERSION: "10.32.1"
+    TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
+    TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
 
 jobs:
     scan:
@@ -79,6 +81,9 @@ jobs:
                   poetry run pip install --upgrade "pip>=26.0" pip-audit
                   poetry run pip-audit --ignore-vuln CVE-2026-3219
 
+            - name: Apt update (for Trivy .deb)
+              run: sh scripts/ci/exec-priv.sh apt-get update -qq
+
             - name: Setup Trivy
               run: sh scripts/ci/setup-trivy.sh