chore(deps): update https://gitea.t000-n.de/t.behrendt/trivy-actions digest to

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | patch | `v6.0.2` → `v6.0.3` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare Source](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3)

- Fix checkout init for SHA-256 repositories by [@&#8203;yaananth](https://github.com/yaananth) in [#&#8203;2439](https://github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@&#8203;yaananth](https://github.com/yaananth) in [#&#8203;2414](https://github.com/actions/checkout/pull/2414)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=-->

Reviewed-on: #18
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>

.gitea/workflows/cd.yaml

@@ -10,15 +10,15 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@b8806ee0141a44be30e8734dff15001361be100c # 0.1.35
         with:
           token: ${{ secrets.GITEA_TOKEN }}
       - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/prerelease.yaml

@@ -8,16 +8,16 @@ jobs:
     name: Prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@b8806ee0141a44be30e8734dff15001361be100c # 0.1.35
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: true
       - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/run-trivy-scan.yaml

@@ -23,6 +23,11 @@ on:
         required: false
         type: string
         default: ""
+      scan-fs:
+        description: "Run Trivy file system scan on the repository root."
+        required: false
+        type: boolean
+        default: false
     outputs:
       merged-sarif-artifact:
         description: "Artifact name containing the merged SARIF file (download this artifact; file inside is merged-sarif.json)."
@@ -36,9 +41,9 @@ jobs:
     if: inputs.scan-config
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.4.4
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.4.4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
       - run: |
           trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output config-sarif.json .
         env:
@@ -52,12 +57,12 @@ jobs:
     if: inputs.scan-images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.4.4
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.4.4 
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7 
       - name: Get images from files
         id: get-images
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@1.4.4
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
         with:
           files: ${{ inputs.image-scan-files }}
       - name: Pull images
@@ -97,7 +102,7 @@ jobs:
           TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
       - name: Merge image SARIF files
         if: steps.get-images.outputs.images != '[]' && steps.scan.outputs.count != '0'
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.4
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.7
         with:
           files: ${{ steps.scan.outputs.files }}
           output-file: image-sarif.json
@@ -110,9 +115,28 @@ jobs:
           name: image-sarif
           path: image-sarif.json
 
+  fs-scan:
+    if: inputs.scan-fs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
+      - run: |
+          server="${{ inputs.trivy-server-url }}"
+          args=(fs --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output fs-sarif.json --scanners vuln .)
+          [ -n "$server" ] && args+=(--server "$server")
+          trivy "${args[@]}"
+        env:
+          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
+      - uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4
+        with:
+          name: fs-sarif
+          path: fs-sarif.json
+
   merge:
     runs-on: ubuntu-latest
-    needs: [config-scan, image-scan]
+    needs: [config-scan, image-scan, fs-scan]
     if: always() && (needs.config-scan.result == 'success' || needs.config-scan.result == 'skipped') && (needs.image-scan.result == 'success' || needs.image-scan.result == 'skipped') && (inputs.scan-config || inputs.scan-images)
     outputs:
       merged-sarif-artifact: ${{ steps.outputs.outputs.merged-sarif-artifact }}
@@ -145,12 +169,15 @@ jobs:
           if [ "${{ inputs.scan-images }}" = "true" ] && [ -f image-sarif-artifact/image-sarif.json ]; then
             [ -n "$files" ] && files="$files"$'\n'"  - image-sarif-artifact/image-sarif.json" || files="- image-sarif-artifact/image-sarif.json"
           fi
+          if [ "${{ inputs.scan-fs }}" = "true" ] && [ -f fs-sarif-artifact/fs-sarif.json ]; then
+            [ -n "$files" ] && files="$files"$'\n'"  - fs-sarif-artifact/fs-sarif.json" || files="- fs-sarif-artifact/fs-sarif.json"
+          fi
           echo "files<<EOF" >> "$GITHUB_OUTPUT"
           echo "$files" >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
       - name: Merge SARIF files
         id: merge-step
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.4
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
         with:
           files: ${{ steps.file-list.outputs.files }}
           output-file: merged-sarif.json