From 4bd3b4a19f5e56e49927dc6d45772ccbf79fae58 Mon Sep 17 00:00:00 2001 From: Julien Gautier Date: Wed, 6 May 2026 23:40:17 +0200 Subject: [PATCH] fix(ci): authenticate trivy-action's github.com clone On cache miss, `aquasecurity/trivy-action@master` falls back to `git clone https://github.com/aquasecurity/trivy` to fetch its install script. The act_runner cache server is currently unreachable from job containers (documented as "Cache server (deferred)" in infra/README.md), so every run is a cache miss, so every run hits the github.com anonymous rate limit and fails with: fatal: could not read Username for 'https://github.com';: terminal prompts disabled Pass `GITHUBCOM_TOKEN` (the same zero-scope github.com PAT we use for Renovate) as `GITHUB_TOKEN` env on the step. The action picks it up automatically and authenticates the clone, lifting the rate limit from 60 req/h anonymous to 5 000 req/h authenticated. This unblocks the `scan` job. The cache server fix would also unblock it (no fall-back clone in the first place), but is a separate, larger infra change still pending. --- .gitea/workflows/ci.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index f93227c..885224d 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -66,6 +66,15 @@ jobs: # Dependency vulnerability scan (binary tool, invoked via official # action — Trivy is a Go binary, not an npm package, so it cannot # live in package.json scripts as cleanly as audit/lint do). + # + # On cache miss (the act_runner cache server is currently + # unreachable from job containers — see infra/README.md "Cache + # server (deferred)"), the action falls back to `git clone + # https://github.com/aquasecurity/trivy` to fetch its install + # script. Without auth that hits github.com's 60 req/h anonymous + # rate limit and `git fetch` fails with "could not read Username". + # GITHUBCOM_TOKEN is the same zero-scope github.com PAT we use + # for Renovate (per docs/development.md "Dependency updates"). - uses: aquasecurity/trivy-action@master with: scan-type: fs @@ -73,6 +82,8 @@ jobs: skip-dirs: node_modules exit-code: '1' severity: 'CRITICAL,HIGH' + env: + GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }} # Secret scan, same reasoning (gitleaks is a Go binary). - uses: gitleaks/gitleaks-action@v2 env: -- 2.30.2