Julien Gautier
3172c0353b
Setting `GITHUB_TOKEN` env on `aquasecurity/trivy-action@master` did not authenticate the github.com clone (#44 attempted that). Reason: the action wraps `actions/checkout`, whose `with.token` input defaults to `${{ github.token }}` (Gitea's auto-token, not our github.com PAT), and that input wins over the GITHUB_TOKEN env variable. The clone keeps hitting the anonymous rate limit. Rather than chase the action's internals (INPUT_TOKEN tricks, git config insteadOf, etc.), drop the wrapper entirely and install Trivy directly via `curl + tar` from the GitHub release artefact. Side benefits: - Pinned version (`TRIVY_VERSION=0.70.0`) — no more `@master`, which is itself an anti-pattern (moving target, surprise breaking changes are exactly what bit us in #43). - Predictable behaviour, fewer indirections to debug. - GITHUBCOM_TOKEN passed as Bearer header on the curl — handles the rate limit on release downloads as defence-in-depth (release artefacts are usually unmetered, but the auth is free). Trivy version bumps are now manual (Renovate cannot track this pin out of the box). A custom regex manager in renovate.json could be added later if the cadence justifies it; for now manual review of https://github.com/aquasecurity/trivy/releases is fine.
Documentation index
This is the entry point to all project documentation. It is maintained automatically: any addition, rename, or removal of a .md file under docs/ must be reflected here in the same change.
Conventions
- Documentation is written in English.
- One topic per file. Group related files into a folder when there are three or more.
- Cross-reference with relative links so they keep working in GitHub, IDEs, and exported sites.
- For architectural decisions, do not add them here — they belong in decisions/ as MADR 4.0.0 ADRs.
Sections
Daily development
- development.md — repo layout, prerequisites, initial setup, daily commands, dependency updates (Renovate), conventional commit cycle. Day-to-day reference for working on the project.
Architecture
- architecture.md — cross-cutting Mermaid diagrams: C4 system context, C4 containers, Nx module boundaries, CI/CD pipeline. Single-decision diagrams (auth sequence, ERD, etc.) live inline in their ADR.
Onboarding & environment
Setup guides for new contributors:
- setup/01-wsl-terminal-setup.md — modern WSL terminal (Zsh + Powerlevel10k + CLI tools)
- setup/02-dev-web-stack.md — Node via nvm, pnpm via corepack, Docker
- setup/03-angular-nx-monorepo.md — Angular + Nx monorepo bootstrap
Operations & runbooks
Empty — to be populated when we deploy.
Security, performance, accessibility
Empty — placeholders to be filled with rationale docs alongside their corresponding ADRs.