From fc79c57f7ec6272c52d1b7feafbfdef6498f97a4 Mon Sep 17 00:00:00 2001 From: Tomas Dvorak Date: Mon, 21 Sep 2026 13:35:25 +0200 Subject: [PATCH] ci: run Trivy via container image, not the action The trivy-action setup step downloads its binary through the unauthenticated GitHub API and dies to rate limits on shared runners. Running aquasec/trivy against the docker socket has no API dependency and is one line shorter. Authored By: TDvorak Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cb0519a..d088e30 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -130,14 +130,16 @@ jobs: frontend) docker run --rm --entrypoint sh primora-frontend:test -c 'test -f /usr/share/nginx/html/index.html' ;; esac + # Trivy via its container image — the action's binary installer is + # rate-limited by unauthenticated GitHub API calls on shared runners. - name: Scan ${{ matrix.app }} image - uses: aquasecurity/trivy-action@v0.33.1 - with: - image-ref: primora-${{ matrix.app }}:test - severity: CRITICAL,HIGH - ignore-unfixed: true - exit-code: '0' - format: table + run: >- + docker run --rm + -v /var/run/docker.sock:/var/run/docker.sock + aquasec/trivy:0.65.0 + image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 0 + --format table + primora-${{ matrix.app }}:test docker-publish: name: Publish edge images