ci: consolidate validation and split lightweight probes

2026-08-29 06:59:02 +02:00
parent 19df5f7508
commit fe92a7f491
5 changed files with 135 additions and 126 deletions
@@ -23,27 +23,15 @@ jobs:
              image --scanners vuln --severity HIGH,CRITICAL \
              --ignore-unfixed --exit-code 1 "$image"
          done
-      - name: Generate API CycloneDX SBOM
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-api-release
-          format: cyclonedx
-          output: mobilityops-api-sbom.cdx.json
-      - name: Generate web CycloneDX SBOM
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-web-release
-          format: cyclonedx
-          output: mobilityops-web-sbom.cdx.json
-      - name: Generate backup-tools CycloneDX SBOM
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
-        with:
-          scan-type: image
-          image-ref: mobilityops-backup-tools-release
-          format: cyclonedx
-          output: mobilityops-backup-tools-sbom.cdx.json
+      - name: Generate CycloneDX SBOMs with the pinned scanner image
+        run: |
+          for component in api web backup-tools; do
+            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$PWD:/work" -w /work \
+              aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
+              image --format cyclonedx --output "mobilityops-${component}-sbom.cdx.json" \
+              "mobilityops-${component}-release"
+          done
      - name: Record immutable image metadata
        run: |
          docker image inspect mobilityops-api-release > mobilityops-api-image.json
@@ -52,7 +40,7 @@ jobs:
          python scripts/generate-release-provenance.py
          sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json release-provenance.json > SHA256SUMS
      - name: Upload release evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3; Gitea-compatible artifact protocol
        with:
          name: mobilityops-${{ github.ref_name }}-evidence
          path: |