From 6153c81602d5a4f351100fac2469e2c6b931a87f Mon Sep 17 00:00:00 2001 From: julien Date: Wed, 6 May 2026 23:43:19 +0200 Subject: [PATCH] fix(ci): authenticate trivy-action's github.com clone (#44) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary On cache miss, `aquasecurity/trivy-action@master` falls back to `git clone https://github.com/aquasecurity/trivy` to fetch its install script. Our act_runner cache server is currently unreachable from job containers (documented as "Cache server (deferred)" in `infra/README.md`), so every CI run is a cache miss, every run does the clone, and every clone hits github.com's 60 req/h anonymous rate limit: Pass `GITHUBCOM_TOKEN` (same zero-scope github.com PAT used for Renovate) as `GITHUB_TOKEN` env on the trivy step. The action picks it up automatically and authenticates the clone, lifting the rate limit from 60 → 5 000 req/h. ## Test plan - [ ] `scan` job goes green on this PR (the trivy step in particular). - [ ] On `push` to main post-merge, scan stays green. - [ ] No regression on the audit / gitleaks sub-steps of `scan`. ## Related - The deeper fix (re-enabling the act_runner cache server so trivy gets a real cache hit and skips the clone entirely) is tracked as "Cache server (deferred)" in `infra/README.md`. Worth doing eventually; this PR is the surgical fix. - The `@master` pin on the trivy-action is also worth replacing with a tagged version (`renovate.json` will surface bumps once we lift the major-dashboard gate for it). Out of scope for this PR. --------- Co-authored-by: Julien Gautier Reviewed-on: https://git.unespace.com/julien/apf_portal/pulls/44 --- .gitea/workflows/ci.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index f93227c..885224d 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -66,6 +66,15 @@ jobs: # Dependency vulnerability scan (binary tool, invoked via official # action — Trivy is a Go binary, not an npm package, so it cannot # live in package.json scripts as cleanly as audit/lint do). + # + # On cache miss (the act_runner cache server is currently + # unreachable from job containers — see infra/README.md "Cache + # server (deferred)"), the action falls back to `git clone + # https://github.com/aquasecurity/trivy` to fetch its install + # script. Without auth that hits github.com's 60 req/h anonymous + # rate limit and `git fetch` fails with "could not read Username". + # GITHUBCOM_TOKEN is the same zero-scope github.com PAT we use + # for Renovate (per docs/development.md "Dependency updates"). - uses: aquasecurity/trivy-action@master with: scan-type: fs @@ -73,6 +82,8 @@ jobs: skip-dirs: node_modules exit-code: '1' severity: 'CRITICAL,HIGH' + env: + GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }} # Secret scan, same reasoning (gitleaks is a Go binary). - uses: gitleaks/gitleaks-action@v2 env: