From 454d2dc8f7ffb184cd5dc48bae1d803b1efb7440 Mon Sep 17 00:00:00 2001 From: Marvin Wade Date: Mon, 21 Sep 2026 15:41:25 -0400 Subject: [PATCH] Replace flaky git-based Trivy installer with pinned binary curl (v0.16.76) --- .github/workflows/container.yml | 16 ++++++++++------ ROADMAP.md | 2 ++ package.json | 2 +- src/public/index.html | 4 ++-- 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index c2c2362..a294db8 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -52,13 +52,17 @@ jobs: - name: Verify Node and built-in SQLite run: docker run --rm --entrypoint node site-gateway:smoke-test --input-type=module -e "import { DatabaseSync } from 'node:sqlite'; const db = new DatabaseSync(':memory:'); db.exec('CREATE TABLE smoke (id INTEGER)'); db.close();" + - name: Install Trivy + run: | + set -e + TRIVY_VERSION=0.56.2 + curl -sfL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o /tmp/trivy.tar.gz + tar -xzf /tmp/trivy.tar.gz -C /tmp trivy + sudo mv /tmp/trivy /usr/local/bin/trivy + trivy --version + - name: Scan image for vulnerabilities - uses: aquasecurity/trivy-action@0.35.0 - with: - image-ref: site-gateway:smoke-test - severity: CRITICAL,HIGH - exit-code: "0" - format: table + run: trivy image --severity CRITICAL,HIGH --exit-code 0 --format table site-gateway:smoke-test - name: Build and publish uses: docker/build-push-action@v6 diff --git a/ROADMAP.md b/ROADMAP.md index 78b5b50..882b39c 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -274,3 +274,5 @@ Roughly in priority order: `v0.16.74` fixes an inaccurate status label on Hosted Site, Proxy Host, and Streaming Host cards, and the Certificates table's Upstream column: a route with monitoring intentionally turned off via "Monitor this site/upstream" in Advanced options -- while the route itself stays enabled and running -- read "Monitoring paused", the same text used for a route that's fully disabled. "Paused" implies a temporary interruption; deliberately unchecking the monitor box is an ongoing, intentional setting. The backend already distinguished the two cases (`status: "disabled"` when the route itself is off vs. `status: "unmonitored"` when only health checks are off, in `checkProxy()`), the frontend just collapsed them into one string in four places. Disabled routes keep "Monitoring paused"; a running route with health checks off now reads "Monitoring disabled". No backend or status-logic changes, text only. `v0.16.75` is a one-line smoke test to confirm the Gitea remote (`git.us2plus2.com/marvin/site-gateway`) actually receives pushes end-to-end after the GitHub-to-Gitea migration: the Dashboard heading text reads "Dashboard v2" instead of "Dashboard" (both the static HTML fallback and the JS that sets it on render), with no other functional change. Pushed to both `origin` (Gitea) and `github` remotes per the dual-push arrangement while GitHub CI still builds the published container image. + +`v0.16.76` fixes the Gitea Actions container-publish pipeline, which failed twice after the earlier GitHub-to-Gitea migration -- first at registry sign-in (missing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` repo secrets, added directly in Gitea's Actions settings, no workflow change needed) and then at the "Scan image for vulnerabilities" step, which used `aquasecurity/trivy-action@0.35.0`. That action installs Trivy at runtime via a `git clone`-based installer script against GitHub, a dependency separate from the registry sign-in fix and one that doesn't reliably resolve from a Gitea Actions runner. Replaced with two plain shell steps: a pinned `curl` of Trivy 0.56.2's release tarball directly from GitHub's release CDN (a single static HTTPS download, not a git checkout) followed by `trivy image` run directly, keeping the same severity/exit-code/format settings. Scanning behavior is unchanged; only the installation mechanism moved off the flaky git-based installer. diff --git a/package.json b/package.json index d2d6fb4..b66695e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "site-gateway", - "version": "0.16.75", + "version": "0.16.76", "private": true, "description": "Site Gateway: simple self-hosted website publishing, reverse proxying, and automatic HTTPS.", "type": "module", diff --git a/src/public/index.html b/src/public/index.html index 4c2a8bb..255422d 100644 --- a/src/public/index.html +++ b/src/public/index.html @@ -11,7 +11,7 @@ - + - +