The docker gate has been failing on `curl: (22) ... error: 404` against
the v0.58.0 GitHub release tarball even after pinning the version. The
helm gate's kubeconform download from github.com/yannh/kubeconform works
in the same workflow, so it's a Trivy-asset-path-specific 404 (URL/CDN
state we don't control), not a blanket github.com block.
Switch to `aquasec/trivy:0.58.0` pulled from Docker Hub:
- Docker Hub is already proven reachable by the preceding `docker build`
steps (server image base layers pull successfully in this same dind
job).
- A pinned tag's manifest digest is itself the verifiable artifact — no
separate checksum file fetch and grep dance.
- Trivy runs against the just-built `cleveragents-server:test` image
via the mounted dind docker socket.
- Same severity gating (`--severity HIGH,CRITICAL --exit-code 1`) and
same trailing detailed-report step are preserved verbatim.
ISSUES CLOSED: #1927
The prior pin used TRIVY_VERSION=0.57.1, but Trivy never published a
v0.57.1 tag — the release sequence went v0.57.0 → v0.58.0. The CI
docker job consequently failed with `curl: (22) The requested URL
returned error: 404` when fetching trivy_0.57.1_Linux-64bit.tar.gz.
- Bump TRIVY_VERSION to 0.58.0 (the first stable release after v0.57.0).
- Factor the GitHub release base URL into TRIVY_BASE_URL.
- Add explicit `set -euo pipefail` so each curl failure surfaces
immediately instead of relying on the runner's implicit -e.
- Anchor the checksum grep with ` ${TRIVY_TARBALL}$` so a partial
filename match cannot smuggle in the wrong checksum line.
- Wrap the checksum verification in a subshell so `cd /tmp` does not
affect later commands.
ISSUES CLOSED: #1927
- Pin Trivy installation to v0.57.1 with checksum verification instead
of the insecure curl-pipe-sh install pattern
- Fix BDD step context initialization: load workflow_content in the
Background step so scenarios 17/24/31 no longer error with AttributeError
- Fix ruff format violations in step definitions
- Add Robot Framework integration test verifying CI scan configuration
- Add CHANGELOG entry for issue #1927
ISSUES CLOSED: #1927
Added Trivy-based security scanning to the CI pipeline for the Dockerfile.server image.
The scan is configured to fail the build on any HIGH or CRITICAL severity vulnerabilities,
preventing insecure images from being deployed to production.
Changes:
- Added security scan step to .forgejo/workflows/ci.yml docker job
- Trivy is installed and executed after building the Dockerfile.server image
- Scan results are displayed in CI job output with detailed vulnerability report
- Build fails (non-zero exit) if HIGH or CRITICAL vulnerabilities are detected
- Added BDD feature file and step definitions for security scanning verification
CleverAgents Bot
HAL9000
cleveragents-auto
controller-ci-rerun