From 7379f6be8ccc7215915385c05ba15760a390e140 Mon Sep 17 00:00:00 2001 From: willemjan Date: Sun, 26 Jul 2026 14:54:43 +0200 Subject: [PATCH] pin trivy-action to the last docker-based release @master resolves to a version that installs Trivy via a nested setup-trivy composite action, which does an actions/checkout against github.com with a token. On Gitea's act_runner that fails with "Input required and not supplied: token" even when the token is explicitly set to an empty string (act_runner doesn't distinguish empty from unset). v0.26.0 introduced that composite/setup-trivy split; v0.25.0 is the last release that ships as a self-contained Docker image with Trivy already baked in, so it needs no token at all. Co-Authored-By: Claude Sonnet 5 --- .gitea/workflows/pipeline.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/pipeline.yml b/.gitea/workflows/pipeline.yml index fb51017..d9ace9b 100644 --- a/.gitea/workflows/pipeline.yml +++ b/.gitea/workflows/pipeline.yml @@ -50,15 +50,21 @@ jobs: run: docker build -t gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} . - name: Trivy scan - uses: aquasecurity/trivy-action@master + # Gepind op de laatste Docker-gebaseerde release: vanaf v0.26.0 installeert + # deze action Trivy via een los 'setup-trivy'-composite-action dat zelf een + # actions/checkout met een GitHub-token doet. Op act_runner (Gitea) faalt + # dat met "Input required and not supplied: token" — ook met een expliciet + # lege token-setup-trivy-input, want act_runner onderscheidt "leeg" niet + # van "niet meegegeven". v0.25.0 draait als kant-en-klare Docker-image en + # heeft dat probleem niet. + uses: aquasecurity/trivy-action@v0.25.0 with: image-ref: gitea.zb-kw.duckdns.org/willemjan/glucose-dashboard:${{ gitea.sha }} - severity: CRITICAL,HIGH + format: table exit-code: "1" # laat de pipeline falen bij kritieke kwetsbaarheden - # gitea.token is geen geldig GitHub-token; leeg laten zodat setup-trivy - # de aquasecurity/trivy-repo anoniem kan clonen in plaats van een - # ongeldige Authorization-header naar github.com te sturen. - token-setup-trivy: "" + ignore-unfixed: true + vuln-type: os,library + severity: CRITICAL,HIGH - name: Login bij Gitea-registry run: echo "${{ secrets.GLUCOSE_TOKEN }}" | docker login gitea.zb-kw.duckdns.org -u willemjan --password-stdin -- 2.54.0