dandri/MeshChatX
1
0
Fork 0
mirror of https://git.quad4.io/RNS-Things/MeshChatX.git synced 2026-08-29 01:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(ci): update Trivy installation method and versioning in CI workflows

Browse Source
This commit is contained in:
Ivan
2026-05-02 05:25:49 -05:00
parent da83df9c30
commit b424a6d492
3 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-release.yml
+3 -2
View File
@@ -40,8 +40,9 @@ env:
POETRY_VERSION: "2.3.4"
PNPM_VERSION: "10.33.0"
COSIGN_VERSION: "3.0.6"
TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
# Official .deb from aquasecurity/trivy releases; scripts/ci/setup-trivy.sh verifies
# checksums.txt (sigstore) + .deb SHA256 + .deb (sigstore). Bump with upstream tags.
TRIVY_VERSION: "0.69.3"
jobs:
frontend:
.github/workflows/security-scan.yml
+3 -2
View File
@@ -32,8 +32,9 @@ env:
NODE_VERSION: "24"
POETRY_VERSION: "2.3.4"
PNPM_VERSION: "10.32.1"
TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
COSIGN_VERSION: "3.0.6"
# Official .deb; setup-trivy.sh verifies sigstore + SHA256 (see build-release.yml).
TRIVY_VERSION: "0.69.3"
jobs:
scan:
scripts/ci/setup-trivy.sh
+9 -3
View File
@@ -1,7 +1,13 @@
#!/bin/sh
# Install Trivy .deb for CI (scan / docker workflows). Upstream path: Sigstore on
# trivy_${VER}_checksums.txt, SHA256 of the .deb against that file, then Sigstore on the .deb.
# Custom mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).
# Install Trivy .deb for CI (scan / docker workflows).
#
# Default (no TRIVY_DEB_URL): official assets from
# https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/
# 1) cosign verify-blob on trivy_${VER}_checksums.txt (+ .sigstore.json)
# 2) sha256sum -c for the arch .deb using that checksums file
# 3) cosign verify-blob on the .deb (+ .deb.sigstore.json)
#
# Optional mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).
set -eu
COSIGN_VERSION="${COSIGN_VERSION:-3.0.6}"