From 26a8b076baed587954f4812a632bbe0c53f5c079 Mon Sep 17 00:00:00 2001 From: TO Date: Thu, 15 Oct 2026 23:23:22 +0200 Subject: [PATCH] ci: use reachable Trivy database mirror --- .gitea/workflows/ci.yml | 2 +- docs/gitea-actions.md | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 09791f1..68961d7 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -136,7 +136,7 @@ jobs: run: /tmp/semgrep/bin/semgrep scan --config p/javascript --config p/typescript --metrics off --sarif --output semgrep-results.sarif src scripts - name: Dependency and secret scan if: ${{ !cancelled() }} - run: trivy fs --format sarif --output trivy-results.sarif --skip-dirs node_modules,dist,coverage . + run: trivy fs --db-repository public.ecr.aws/aquasecurity/trivy-db:2 --format sarif --output trivy-results.sarif --skip-dirs node_modules,dist,coverage . - name: Security reports if: ${{ always() }} uses: https://gitea.com/actions/upload-artifact@v3 diff --git a/docs/gitea-actions.md b/docs/gitea-actions.md index 696f21b..39e8dcf 100644 --- a/docs/gitea-actions.md +++ b/docs/gitea-actions.md @@ -36,6 +36,8 @@ branch slug; stable promotions share one group and are not cancelled in progress Validation uses Node 24.21.0 and Bun 1.4.2 with the frozen lockfile. The image job uses Docker 29.8.2 and its matching Docker-in-Docker service. Scanner versions are Semgrep 1.180.0 and Trivy 0.75.0; Trivy downloads are checksum-checked. +Trivy downloads its vulnerability database from Aqua's public ECR mirror because +the default registries returned a missing database blob and a download timeout. Jobs select the `ubuntu-latest` label and require Linux container-job support. Allow at least the preserved 2 GiB Node heap plus runner and container overhead.