From b424a6d4920e092a6ff31c93711eb8e07987d969 Mon Sep 17 00:00:00 2001
From: Ivan <ivan@quad4.io>
Date: Sat, 2 May 2026 05:25:49 -0500
Subject: [PATCH] chore(ci): update Trivy installation method and versioning in
 CI workflows

---
 .github/workflows/build-release.yml |  5 +++--
 .github/workflows/security-scan.yml |  5 +++--
 scripts/ci/setup-trivy.sh           | 12 +++++++++---
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 8fa9e99..969c85b 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -40,8 +40,9 @@ env:
     POETRY_VERSION: "2.3.4"
     PNPM_VERSION: "10.33.0"
     COSIGN_VERSION: "3.0.6"
-    TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
-    TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
+    # Official .deb from aquasecurity/trivy releases; scripts/ci/setup-trivy.sh verifies
+    # checksums.txt (sigstore) + .deb SHA256 + .deb (sigstore). Bump with upstream tags.
+    TRIVY_VERSION: "0.69.3"
 
 jobs:
     frontend:
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index ef62a6b..6564eb2 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,8 +32,9 @@ env:
     NODE_VERSION: "24"
     POETRY_VERSION: "2.3.4"
     PNPM_VERSION: "10.32.1"
-    TRIVY_DEB_URL: "https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb"
-    TRIVY_DEB_SHA256: "a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358"
+    COSIGN_VERSION: "3.0.6"
+    # Official .deb; setup-trivy.sh verifies sigstore + SHA256 (see build-release.yml).
+    TRIVY_VERSION: "0.69.3"
 
 jobs:
     scan:
diff --git a/scripts/ci/setup-trivy.sh b/scripts/ci/setup-trivy.sh
index 191a802..e697a3b 100644
--- a/scripts/ci/setup-trivy.sh
+++ b/scripts/ci/setup-trivy.sh
@@ -1,7 +1,13 @@
 #!/bin/sh
-# Install Trivy .deb for CI (scan / docker workflows). Upstream path: Sigstore on
-# trivy_${VER}_checksums.txt, SHA256 of the .deb against that file, then Sigstore on the .deb.
-# Custom mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).
+# Install Trivy .deb for CI (scan / docker workflows).
+#
+# Default (no TRIVY_DEB_URL): official assets from
+# https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/
+#   1) cosign verify-blob on trivy_${VER}_checksums.txt (+ .sigstore.json)
+#   2) sha256sum -c for the arch .deb using that checksums file
+#   3) cosign verify-blob on the .deb (+ .deb.sigstore.json)
+#
+# Optional mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).
 set -eu
 
 COSIGN_VERSION="${COSIGN_VERSION:-3.0.6}"