From 77eaf22c0c94aebb8dba80efb1b020b1786d4d36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 9 Sep 2026 20:04:13 +0200 Subject: [PATCH] ci: install Trivy from its release, not through apt The scanner job installed Trivy through apt, which runs `apt-get update` across every repository on the runner image. On the v1.38.12 merge commit the runner's preinstalled Chrome repository answered with a corrupt index ("Hash Sum mismatch") twice in a row, and the release gate went red on a step that has nothing to do with the image under test. The step now fetches the pinned release binary through Trivy's own installer, which downloads the tarball for that exact version and checks it against the published checksums. No apt, so no unrelated repository can fail the job. --- .github/workflows/security.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index f0e42e8e5..774f04be7 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -131,12 +131,19 @@ jobs: - name: Build Docker image run: docker build -t healthlog:scan . + # The release binary, pinned, straight from the Trivy release. The apt + # route ran `apt-get update` across every repository on the runner + # image, and an unrelated one (the Chrome repository the runner ships + # with) answering with a corrupt index failed the step twice in a row + # on a release commit. The installer downloads the tarball for this + # exact version and checks it against the published checksums. - name: Install Trivy + env: + TRIVY_VERSION: v0.74.0 run: | - sudo apt-get install -y wget apt-transport-https gnupg - wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null - echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list - sudo apt-get update && sudo apt-get install -y trivy + curl -sfL "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" \ + | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}" + trivy --version # Blocking since v1.15.20 — a HIGH/CRITICAL finding in the built # image fails the job. For a finding without an upstream fix