Merge remote-tracking branch 'origin/master' into codex/resolve-projectbrain-findings-20260828

# Conflicts: # .dockerignore # .gitea/workflows/ci.yml # .gitea/workflows/live-canary.yml # .gitea/workflows/release.yml
2026-09-01 20:42:10 +02:00
parent e8eed3e641 4257fea9d6
commit 92bdfb421b
63 changed files with 434 additions and 6998 deletions
@@ -23,27 +23,15 @@ jobs:
              image --scanners vuln --severity HIGH,CRITICAL \
              --ignore-unfixed --exit-code 1 "$image"
          done
-      - name: Generate API CycloneDX SBOM
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-api-release
-          format: cyclonedx
-          output: mobilityops-api-sbom.cdx.json
-      - name: Generate web CycloneDX SBOM
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-web-release
-          format: cyclonedx
-          output: mobilityops-web-sbom.cdx.json
-      - name: Generate backup-tools CycloneDX SBOM
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-backup-tools-release
-          format: cyclonedx
-          output: mobilityops-backup-tools-sbom.cdx.json
+      - name: Generate CycloneDX SBOMs with the pinned scanner image
+        run: |
+          for component in api web backup-tools; do
+            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$PWD:/work" -w /work \
+              aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
+               image --format cyclonedx --output "mobilityops-${component}-sbom.cdx.json" \
+               "mobilityops-${component}-release"
+          done
      - name: Record immutable image metadata
        run: |
          docker image inspect mobilityops-api-release > mobilityops-api-image.json
@@ -52,7 +40,7 @@ jobs:
          python scripts/generate-release-provenance.py
          sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json release-provenance.json > SHA256SUMS
      - name: Upload release evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3; Gitea-compatible artifact protocol
        with:
          name: mobilityops-${{ github.ref_name }}-evidence
          path: |