From 6fc26db1b563e4716855deb18ff9e4cc17a7e5f0 Mon Sep 17 00:00:00 2001 From: julien Date: Thu, 7 May 2026 13:18:51 +0200 Subject: [PATCH] fix(ci): restrict Trivy to vulnerability scanner only (#48) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary First successful Trivy run (post #45's manual install) came back red on three "secret" findings — all demo RSA private keys embedded in the README / test fixtures of a cryptographic npm package, sitting deep in `.pnpm-store/v10/files/...`. None of them are our secrets. Two observations: - The `scan` job already chains `gitleaks/gitleaks-action@v2` right after Trivy. Running two secret scanners over the same tree just doubles the false-positive surface. - Trivy's own log suggests `--scanners vuln` when secret scanning isn't the focus. And [ADR-0015](docs/decisions/0015-cicd-gitea-actions.md) always framed this step as "dependency vulnerability scan" — singular. Restrict Trivy to `--scanners vuln`. Result: vuln scan against `pnpm-lock.yaml` complementing `pnpm audit` (which uses the npm advisory DB; Trivy's DB is broader, sources from OSV/GHSA/etc.). Gitleaks stays the single secret-scan source. No `--skip-dirs` change needed: vuln scanning reads `pnpm-lock.yaml`, not the unpacked store. ## Test plan - [ ] `scan` job goes green end-to-end on this PR — `pnpm ci:audit` ✓, `Install Trivy` ✓, `Run Trivy` ✓ (no secret findings reported), `gitleaks` ✓. - [ ] On `push` to main post-merge, scan stays green. - [ ] Future Trivy bumps (manual, see workflow comment) keep this `--scanners vuln` flag. --------- Co-authored-by: Julien Gautier Reviewed-on: https://git.unespace.com/julien/apf_portal/pulls/48 --- .gitea/workflows/ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 124c794..9c34ece 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -101,8 +101,16 @@ jobs: tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy trivy --version - name: Run Trivy + # `--scanners vuln`: limit Trivy to vulnerability scanning. Its + # secret scanner false-positives on demo RSA keys embedded in + # the README/fixtures of cryptographic npm packages (which + # land under .pnpm-store/), and we already have gitleaks below + # as the dedicated secret-scan gate. Trivy's intent in this + # job, per ADR-0015, was always "dependency vulnerability + # scan" — restoring that scope. run: | trivy fs \ + --scanners vuln \ --ignore-unfixed \ --skip-dirs node_modules \ --exit-code 1 \