fix(ci): isolate contract and image scans from host paths

2026-08-29 00:27:17 +02:00
parent a99aed9a5f
commit 2918608240
3 changed files with 34 additions and 17 deletions
@@ -39,34 +39,20 @@ jobs:
      - name: Contract drift gate
        run: |
          docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm \
-            -v "$PWD:/repo:ro" api python /repo/scripts/check-contracts.py
+            api python scripts/check-contracts.py
          python scripts/check-source-budgets.py
      - name: Build production API image for vulnerability scan
        run: |
          docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" \
            --tag mobilityops-api-ci --file backend/Dockerfile .
      - name: Production API image vulnerability scan (HIGH/CRITICAL)
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-api-ci
-          format: table
-          severity: HIGH,CRITICAL
-          exit-code: "1"
-          ignore-unfixed: true
+        run: bash scripts/scan-ci-image.sh mobilityops-api-ci
      - name: Build production web image for vulnerability scan
        run: |
          docker build --build-arg VCS_REF="$GITHUB_SHA" \
            --tag mobilityops-web-ci frontend
      - name: Production web image vulnerability scan (HIGH/CRITICAL)
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-web-ci
-          format: table
-          severity: HIGH,CRITICAL
-          exit-code: "1"
-          ignore-unfixed: true
+        run: bash scripts/scan-ci-image.sh mobilityops-web-ci
      - name: Remove CI stack
        if: always()
        run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans