From 10ce7b8483b6f0d5c93419a40a71a573605e4f30 Mon Sep 17 00:00:00 2001
From: embeddevio <embeddev.iot@gmail.com>
Date: Wed, 28 Oct 2026 22:31:59 +0300
Subject: [PATCH] =?UTF-8?q?ci(verify):=20trivy=20=D1=87=D0=B5=D1=80=D0=B5?=
 =?UTF-8?q?=D0=B7=20=D0=BE=D0=B1=D1=80=D0=B0=D0=B7=20aquasec/trivy=20+=20?=
 =?UTF-8?q?=D0=BA=D1=8D=D1=88=20=D0=91=D0=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refs #17
---
 .gitea/workflows/ci.yml | 40 +++++++++++++++++++++-------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 2e48d22..c8885f0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -248,35 +248,37 @@ jobs:
       TRIVY_VERSION: "0.76.1"
       TRIVY_SEVERITY: "HIGH,CRITICAL"
     steps:
-      - name: install trivy
-        run: |
-          set -euo pipefail
-          curl -fsSL -o /tmp/trivy.tar.gz \
-            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-          tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy
-          chmod +x /usr/local/bin/trivy
-          trivy --version
-
+      # trivy запускается официальным образом через docker-сокет: не требует
+      # скачивания бинаря (github releases отдаёт медленно) + БД кэшируется в
+      # /opt/trivy-cache на build-хосте.
       - name: "trivy image (HIGH/CRITICAL -> fail)"
         run: |
           set -o pipefail
           IMAGE="${REGISTRY}/${IMAGE_NAME}:staging-${GITHUB_SHA::8}"
           echo "scan: ${IMAGE}"
-          trivy image \
-            --image-src docker \
-            --scanners vuln \
-            --severity "$TRIVY_SEVERITY" \
-            --ignore-unfixed \
-            --exit-code 1 \
-            --format table \
-            "$IMAGE" 2>&1 | tee trivy-report.txt
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v /opt/trivy-cache:/root/.cache/trivy \
+            "aquasec/trivy:${TRIVY_VERSION}" image \
+              --image-src docker --scanners vuln \
+              --severity "$TRIVY_SEVERITY" --ignore-unfixed \
+              --exit-code 1 --format table "$IMAGE" 2>&1 | tee trivy-report.txt
 
       - name: trivy json report
         if: always()
         run: |
+          set -o pipefail
           IMAGE="${REGISTRY}/${IMAGE_NAME}:staging-${GITHUB_SHA::8}"
-          trivy image --image-src docker --scanners vuln --severity "$TRIVY_SEVERITY" \
-            --ignore-unfixed --format json -o trivy-report.json "$IMAGE" || true
+          mkdir -p reports
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v /opt/trivy-cache:/root/.cache/trivy \
+            -v "$PWD/reports:/reports" \
+            "aquasec/trivy:${TRIVY_VERSION}" image \
+              --image-src docker --scanners vuln \
+              --severity "$TRIVY_SEVERITY" --ignore-unfixed \
+              --format json -o /reports/trivy-report.json "$IMAGE" || true
+          cp reports/trivy-report.json ./trivy-report.json 2>/dev/null || true
 
       - name: upload trivy report
         if: always()