From f5fefdea5a28925f1e2014be616f2a8eef87314f Mon Sep 17 00:00:00 2001
From: CleverThis <hal9000@cleverthis.com>
Date: Wed, 17 Jun 2026 17:44:36 -0400
Subject: [PATCH] fix(ci): pin Trivy to v0.58.0 (v0.57.1 is not a real release)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The prior pin used TRIVY_VERSION=0.57.1, but Trivy never published a
v0.57.1 tag — the release sequence went v0.57.0 → v0.58.0. The CI
docker job consequently failed with `curl: (22) The requested URL
returned error: 404` when fetching trivy_0.57.1_Linux-64bit.tar.gz.

- Bump TRIVY_VERSION to 0.58.0 (the first stable release after v0.57.0).
- Factor the GitHub release base URL into TRIVY_BASE_URL.
- Add explicit `set -euo pipefail` so each curl failure surfaces
  immediately instead of relying on the runner's implicit -e.
- Anchor the checksum grep with ` ${TRIVY_TARBALL}$` so a partial
  filename match cannot smuggle in the wrong checksum line.
- Wrap the checksum verification in a subshell so `cd /tmp` does not
  affect later commands.

ISSUES CLOSED: #1927
---
 .forgejo/workflows/ci.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index d8d65030f..399085c05 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -621,14 +621,17 @@ jobs:
 
             - name: Security scan Dockerfile.server image with Trivy
               run: |
-                  # Install Trivy at a pinned version with checksum verification
+                  # Install Trivy at a pinned version with checksum verification.
+                  # v0.58.0 is the first stable release after v0.57.0; v0.57.1 does
+                  # not exist as a Trivy release tag.
+                  set -euo pipefail
                   apk add --no-cache curl tar
-                  TRIVY_VERSION="0.57.1"
-                  ARCH="amd64"
+                  TRIVY_VERSION="0.58.0"
                   TRIVY_TARBALL="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-                  curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${TRIVY_TARBALL}" -o "/tmp/${TRIVY_TARBALL}"
-                  curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
-                  cd /tmp && grep "${TRIVY_TARBALL}" trivy_checksums.txt | sha256sum -c
+                  TRIVY_BASE_URL="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}"
+                  curl -fsSL "${TRIVY_BASE_URL}/${TRIVY_TARBALL}" -o "/tmp/${TRIVY_TARBALL}"
+                  curl -fsSL "${TRIVY_BASE_URL}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
+                  ( cd /tmp && grep " ${TRIVY_TARBALL}\$" trivy_checksums.txt | sha256sum -c - )
                   tar -xzf "/tmp/${TRIVY_TARBALL}" -C /usr/local/bin trivy
                   trivy --version