From 36f41ba43a803a0e166651b5a9bd109c303a8fb1 Mon Sep 17 00:00:00 2001 From: Jens Date: Tue, 18 Aug 2026 14:13:22 +0200 Subject: [PATCH] ci(security): pin trivy-action to an existing tag (v0.30.0) so the gate can resolve on Gitea Actions The first real platform runs (2026-08-17, new instance runner) failed at 'Unable to resolve 0.30.0: reference not found' - the tag exists only as v0.30.0. Where present, the trufflehog GitHub Action (which fails under the act runner) is replaced by the pinned trufflehog binary in filesystem mode next to gitleaks. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b548de..510ad8f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: path: ./ extra_args: --only-verified - name: Scan project dependencies and lockfiles (high/critical) - uses: aquasecurity/trivy-action@0.30.0 + uses: aquasecurity/trivy-action@v0.30.0 with: scan-type: fs scan-ref: . @@ -66,7 +66,7 @@ jobs: - name: Build production image run: docker build --pull --tag vacatureradar:ci . - name: Scan container image for high/critical vulnerabilities - uses: aquasecurity/trivy-action@0.30.0 + uses: aquasecurity/trivy-action@v0.30.0 with: image-ref: vacatureradar:ci format: table @@ -74,7 +74,7 @@ jobs: exit-code: "1" ignore-unfixed: true - name: Generate CycloneDX software bill of materials - uses: aquasecurity/trivy-action@0.30.0 + uses: aquasecurity/trivy-action@v0.30.0 with: image-ref: vacatureradar:ci format: cyclonedx