peetandClaude Fable 5
54cdfad823
- android-signing: the keystore-restore step previously copy-pasted in habitude and ablage-android; no-op without the secret (unsigned build). - trivy-fs-scan: lockfile-based dependency scan for artifact-building repos (APKs); non-blocking by default via enforce input. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
name: Trivy Filesystem Scan
|
|
description: >
|
|
Scan the checked-out workspace for vulnerable dependencies (lockfile-based:
|
|
gradle.lockfile, package-lock.json, etc.) with Trivy. For repos that build
|
|
artifacts rather than container images. Requires the trivy binary on the
|
|
runner (noctrl/gitea-runner >= v9) — pin the job to linux,build,amd64.
|
|
Gradle projects must have dependency locking enabled with committed
|
|
lockfiles, or trivy has nothing to read.
|
|
|
|
inputs:
|
|
path:
|
|
description: Directory to scan.
|
|
required: false
|
|
default: "."
|
|
severity:
|
|
description: Comma-separated Trivy severities to report.
|
|
required: false
|
|
default: HIGH,CRITICAL
|
|
enforce:
|
|
description: >
|
|
"true" fails the job on findings with an available fix; "false" only
|
|
reports them (start non-blocking, flip once the noise level is known).
|
|
required: false
|
|
default: "false"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: scan
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! command -v trivy >/dev/null 2>&1; then
|
|
echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
exit_code=0
|
|
if [[ "${{ inputs.enforce }}" == "true" ]]; then
|
|
exit_code=1
|
|
fi
|
|
|
|
echo "Scanning ${{ inputs.path }} (severities: ${{ inputs.severity }}, enforce: ${{ inputs.enforce }})"
|
|
trivy fs \
|
|
--scanners vuln \
|
|
--severity "${{ inputs.severity }}" \
|
|
--ignore-unfixed \
|
|
--exit-code "${exit_code}" \
|
|
--no-progress \
|
|
"${{ inputs.path }}"
|