6 Commits

Author SHA1 Message Date
renovate-bot b21b9ac600 chore(deps): update https://gitea.t000-n.de/t.behrendt/actions action to v0.2.4 (#52)
CD / Release (push) Successful in 30s
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://gitea.t000-n.de/t.behrendt/actions](https://gitea.t000-n.de/t.behrendt/actions) | action | patch | `0.2.1` → `0.2.4` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>t.behrendt/actions (https://gitea.t000-n.de/t.behrendt/actions)</summary>

### [`v0.2.4`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.3...0.2.4)

[Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.3...0.2.4)

### [`v0.2.3`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.2...0.2.3)

[Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.2...0.2.3)

### [`v0.2.2`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.1...0.2.2)

[Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.1...0.2.2)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=-->

Reviewed-on: #52
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>
2026-06-13 12:51:06 +02:00
renovate-bot 9a14cb5ff3 chore(deps): update actions/cache digest to 27d5ce7 (#50)
CD / Release (push) Successful in 5s
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/cache](https://github.com/actions/cache) ([changelog](https://github.com/actions/cache/compare/cdf6c1fa76f9f475f3d7449005a359c84ca0f306..27d5ce7f107fe9357f9df03efb73ab90386fccae)) | action | digest | `cdf6c1f` → `27d5ce7` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=-->

---------

Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Reviewed-on: #50
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>
2026-06-13 12:50:57 +02:00
renovate-bot 31859149c1 chore(deps): update actions/checkout digest to df4cb1c (#57)
CD / Release (push) Successful in 5s
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) ([changelog](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd..df4cb1c069e1874edd31b4311f1884172cec0e10)) | action | digest | `de0fac2` → `df4cb1c` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=-->

---------

Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Reviewed-on: #57
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>
2026-06-13 12:48:02 +02:00
renovate-bot 3c4aeb81f4 chore(deps): update actions/checkout action to v6.0.3 (#58)
CD / Release (push) Successful in 11s
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | patch | `v6.0.2` → `v6.0.3` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare Source](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3)

- Fix checkout init for SHA-256 repositories by [@&#8203;yaananth](https://github.com/yaananth) in [#&#8203;2439](https://github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@&#8203;yaananth](https://github.com/yaananth) in [#&#8203;2414](https://github.com/actions/checkout/pull/2414)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=-->

Reviewed-on: #58
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>
2026-06-13 12:35:58 +02:00
t.behrendt 2616391b42 Revert "refactor(setup-db): to run trivy in docker (#54)" (#56)
CD / Release (push) Successful in 5s
This reverts commit 81eda53a59.

Reviewed-on: #56
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
2026-04-10 19:36:38 +02:00
t.behrendt 81eda53a59 refactor(setup-db): to run trivy in docker (#54)
CD / Release (push) Successful in 4s
As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised.
Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date.

Reviewed-on: #54
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
2026-04-10 18:43:03 +02:00
5 changed files with 11 additions and 11 deletions
+2 -2
View File
@@ -10,7 +10,7 @@ jobs:
name: Release name: Release
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Increment tag - name: Increment tag
@@ -19,6 +19,6 @@ jobs:
with: with:
token: ${{ secrets.GITEA_TOKEN }} token: ${{ secrets.GITEA_TOKEN }}
- name: Push tag - name: Push tag
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1 uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
with: with:
tag: ${{ steps.tag.outputs.new-tag }} tag: ${{ steps.tag.outputs.new-tag }}
+4 -4
View File
@@ -13,7 +13,7 @@ jobs:
- ubuntu-latest - ubuntu-latest
- linux_${{ matrix.arch }} - linux_${{ matrix.arch }}
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Setup Trivy - name: Setup Trivy
uses: ./setup-trivy uses: ./setup-trivy
- name: Run Trivy - name: Run Trivy
@@ -24,7 +24,7 @@ jobs:
runs-on: runs-on:
- ubuntu-latest - ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: ./setup-trivy - uses: ./setup-trivy
- name: Setup DB - name: Setup DB
id: setup-db id: setup-db
@@ -37,7 +37,7 @@ jobs:
runs-on: runs-on:
- ubuntu-latest - ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- id: giff - id: giff
uses: ./get-images-from-files uses: ./get-images-from-files
with: with:
@@ -88,7 +88,7 @@ jobs:
runs-on: runs-on:
- ubuntu-latest - ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Merge SARIF Files - name: Merge SARIF Files
uses: ./merge-sarif-files uses: ./merge-sarif-files
with: with:
+2 -2
View File
@@ -8,7 +8,7 @@ jobs:
name: Prerelease name: Prerelease
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with: with:
fetch-depth: 0 fetch-depth: 0
- name: Increment tag - name: Increment tag
@@ -18,6 +18,6 @@ jobs:
token: ${{ secrets.GITEA_TOKEN }} token: ${{ secrets.GITEA_TOKEN }}
prerelease: true prerelease: true
- name: Push tag - name: Push tag
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1 uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
with: with:
tag: ${{ steps.tag.outputs.new-tag }} tag: ${{ steps.tag.outputs.new-tag }}
+1 -1
View File
@@ -24,7 +24,7 @@ runs:
run: | run: |
echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
- id: restore-db - id: restore-db
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with: with:
path: ${{ inputs.cache-dir }} path: ${{ inputs.cache-dir }}
key: trivy-db-${{ steps.current-date.outputs.current-date }} key: trivy-db-${{ steps.current-date.outputs.current-date }}
+1 -1
View File
@@ -40,7 +40,7 @@ runs:
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
- name: Cache Trivy binary - name: Cache Trivy binary
id: cache-trivy id: cache-trivy
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with: with:
path: /usr/local/bin/trivy path: /usr/local/bin/trivy
key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }} key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}