ci(verify): trivy через образ aquasec/trivy + кэш БД

Refs #17

.gitea/workflows/ci.yml

@@ -248,35 +248,37 @@ jobs:
       TRIVY_VERSION: "0.76.1"
       TRIVY_SEVERITY: "HIGH,CRITICAL"
     steps:
-      - name: install trivy
+      # trivy запускается официальным образом через docker-сокет: не требует
-        run: |
+      # скачивания бинаря (github releases отдаёт медленно) + БД кэшируется в
-          set -euo pipefail
+      # /opt/trivy-cache на build-хосте.
-          curl -fsSL -o /tmp/trivy.tar.gz \
-            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-          tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy
-          chmod +x /usr/local/bin/trivy
-          trivy --version
-
       - name: "trivy image (HIGH/CRITICAL -> fail)"
         run: |
           set -o pipefail
           IMAGE="${REGISTRY}/${IMAGE_NAME}:staging-${GITHUB_SHA::8}"
           echo "scan: ${IMAGE}"
-          trivy image \
+          docker run --rm \
-            --image-src docker \
+            -v /var/run/docker.sock:/var/run/docker.sock \
-            --scanners vuln \
+            -v /opt/trivy-cache:/root/.cache/trivy \
-            --severity "$TRIVY_SEVERITY" \
+            "aquasec/trivy:${TRIVY_VERSION}" image \
-            --ignore-unfixed \
+              --image-src docker --scanners vuln \
-            --exit-code 1 \
+              --severity "$TRIVY_SEVERITY" --ignore-unfixed \
-            --format table \
+              --exit-code 1 --format table "$IMAGE" 2>&1 | tee trivy-report.txt
-            "$IMAGE" 2>&1 | tee trivy-report.txt
 
       - name: trivy json report
         if: always()
         run: |
+          set -o pipefail
           IMAGE="${REGISTRY}/${IMAGE_NAME}:staging-${GITHUB_SHA::8}"
-          trivy image --image-src docker --scanners vuln --severity "$TRIVY_SEVERITY" \
+          mkdir -p reports
-            --ignore-unfixed --format json -o trivy-report.json "$IMAGE" || true
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v /opt/trivy-cache:/root/.cache/trivy \
+            -v "$PWD/reports:/reports" \
+            "aquasec/trivy:${TRIVY_VERSION}" image \
+              --image-src docker --scanners vuln \
+              --severity "$TRIVY_SEVERITY" --ignore-unfixed \
+              --format json -o /reports/trivy-report.json "$IMAGE" || true
+          cp reports/trivy-report.json ./trivy-report.json 2>/dev/null || true
 
       - name: upload trivy report
         if: always()