dandri/MeshChatX
1
0
Fork 0
mirror of https://git.quad4.io/RNS-Things/MeshChatX.git synced 2026-08-29 07:48:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(workflows): add Trivy setup and update steps in build and security scan workflows

Browse Source
This commit is contained in:
Ivan
2026-04-27 11:14:42 -05:00
parent 594e33938f
commit 6ea4b37cb9
3 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-linux-release.yml
+6
View File
@@ -37,6 +37,8 @@ env:
POETRY_VERSION: "2.3.4"
PNPM_VERSION: "10.33.0"
COSIGN_VERSION: "3.0.6"
TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
jobs:
frontend:
@@ -116,6 +118,9 @@ jobs:
- name: Setup Task
run: sh scripts/ci/setup-task.sh
- name: Apt update (for Trivy .deb)
run: sh scripts/ci/exec-priv.sh apt-get update -qq
- name: Setup Trivy
run: sh scripts/ci/setup-trivy.sh
@@ -138,6 +143,7 @@ jobs:
GITHUB_RUN_ID: ${{ github.run_id }}
GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
GITHUB_WORKFLOW: ${{ github.workflow }}
GITHUB_WORKFLOW_FILE: build-linux-release.yml
COSIGN_VERSION: ${{ env.COSIGN_VERSION }}
run: |
set -eu
.github/workflows/build-release.yml
+30
View File
@@ -36,6 +36,7 @@ env:
NODE_VERSION: "24"
POETRY_VERSION: "2.3.4"
PNPM_VERSION: "10.32.1"
COSIGN_VERSION: "3.0.6"
jobs:
frontend:
@@ -199,6 +200,9 @@ jobs:
permissions:
contents: write
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- name: Download Windows dist
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
with:
@@ -217,6 +221,32 @@ jobs:
name: ${{ needs.slsa-provenance-desktop.outputs.provenance-name }}
path: upload
- name: SLSA cosign bundles (desktop assets)
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_SHA: ${{ github.sha }}
GITHUB_REF: ${{ github.ref }}
GITHUB_RUN_ID: ${{ github.run_id }}
GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
GITHUB_WORKFLOW: ${{ github.workflow }}
GITHUB_WORKFLOW_FILE: build-release.yml
COSIGN_VERSION: ${{ env.COSIGN_VERSION }}
run: |
set -eu
if [ -z "${COSIGN_PRIVATE_KEY:-}" ]; then
echo "Skipping cosign attestations (no COSIGN_PRIVATE_KEY)."
exit 0
fi
sh scripts/ci/setup-cosign.sh "${COSIGN_VERSION}"
printf '%s\n' "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key
chmod 600 /tmp/cosign.key
export COSIGN_KEY_PATH=/tmp/cosign.key
sh scripts/ci/attest-release-assets.sh upload
rm -f /tmp/cosign.key
- name: Upload to draft release
env:
GH_TOKEN: ${{ github.token }}
.github/workflows/security-scan.yml
+5
View File
@@ -32,6 +32,8 @@ env:
NODE_VERSION: "24"
POETRY_VERSION: "2.3.4"
PNPM_VERSION: "10.32.1"
TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
jobs:
scan:
@@ -79,6 +81,9 @@ jobs:
poetry run pip install --upgrade "pip>=26.0" pip-audit
poetry run pip-audit --ignore-vuln CVE-2026-3219
- name: Apt update (for Trivy .deb)
run: sh scripts/ci/exec-priv.sh apt-get update -qq
- name: Setup Trivy
run: sh scripts/ci/setup-trivy.sh