[cristim]

Summary

The Run pre-commit hooks job fails on Install Trivy with curl exit 6 (DNS): install.sh makes a second download with no retry. This replaces it with the step cloud-commitments-go merged in LeanerCloud/cloud-commitments-go#669, line for line:

• download the pinned v0.69.3 Linux tarball with curl --retry 5 --retry-all-errors --retry-delay 5;
• verify it against the pinned sha256 from the release's checksums.txt;
• unpack only trivy into /usr/local/bin and print its version.

The installer script is no longer executed at all, so the pin now covers the binary's bytes, not just the tag.

Verification

This PR's own Run pre-commit hooks job exercises the new step. It unblocks #127, whose pre-commit check fails on the same DNS error.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-mcp
• Branch: fix/ci-trivy-pinned-install
• File: .coderabbit.yaml
• Commit: cc7bf90
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: e202b0f0-1860-4e00-952c-794be788ee29

Commits

Reviewing files that changed from the base of the PR and between d455ccb and cc7bf90.

Files selected for processing: 1

• .github/workflows/pre-commit.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[cristim]

APPROVE @ cc7bf90

Cold review (claude-autospotting). CI-only change to .github/workflows/pre-commit.yml (+11/-17), a line-for-line port of LeanerCloud/cloud-commitments-go#669's Trivy install step. No findings.

Checked:

• Checksum. TRIVY_SHA256 (1816b632...c88b75) equals the trivy_0.69.3_Linux-64bit.tar.gz line in the official aquasecurity/trivy v0.69.3 trivy_0.69.3_checksums.txt, which I verified independently for go#669. The asset URL built from ${TRIVY_VERSION#v} names that same file.
• Fails loudly.
  • The step runs under set -euo pipefail.
  • curl -f with --retry 5 --retry-all-errors still exits non-zero once retries run out.
  • sha256sum -c runs before tar, and tar ... trivy plus trivy --version fail on a missing or broken binary.
  • The trivy-config hook in .pre-commit-config.yaml keeps --exit-code 1 with no skip fallback, and the workflow has no continue-on-error.
• Supply chain. Every uses: in the workflow is pinned to a full commit SHA (checkout, setup-python, setup-go, setup-node, cache x3, nick-fields/retry). The curl | sh install.sh path is removed.
• CI at this head is all green. In run 41764058216, the "Run pre-commit hooks" log shows trivy.tgz: OK, Version: 0.69.3 and Trivy config scanner....Passed.

This also fixes the install.sh DNS flake (curl exit 6) that made #127's pre-commit job fail at 6e14495.

[cristim]

Independent review (claude-fleet, cold): APPROVE cc7bf90

I reviewed this cold at cc7bf90 (base d455ccb), treating the PR body and the step comment as claims. CI is green at this SHA, including "Run pre-commit hooks", the job that runs this step.

Checked

• The pinned hash is the upstream one. Aqua's trivy_0.69.3_checksums.txt from the v0.69.3 release lists 1816b632dfe529869c740c0913e36bd1629cb7688bd5634f4a858c1d57c88b75 trivy_0.69.3_Linux-64bit.tar.gz. A fresh download of that tarball hashes to the same value, which is the one pinned in TRIVY_SHA256.

• The right asset and the right member. The job runs on ubuntu-latest (x86-64), so Linux-64bit is correct. The tarball has a top-level trivy binary, which is the only member tar -xzf … trivy extracts. ${TRIVY_VERSION#v} gives 0.69.3, matching the asset name.

• The step, run for real. I ran the exact run: block, extracted from the workflow at this SHA with its env, in an ubuntu:24.04 linux/amd64 container with RUNNER_TEMP set. Mutations ran on scratch copies of the script:

  Variant	Result
  as written	passes; trivy --version reports 0.69.3
  wrong TRIVY_SHA256	fails at sha256sum -c; nothing installed
  tarball modified after download (one byte appended)	fails at sha256sum -c; nothing installed
  non-existent version (v0.69.99)	fails, curl exit 22 (404); nothing installed
  set -e removed, plus a wrong hash	passes and installs the unverified binary
  the same, under GitHub's default bash -eo pipefail shell	fails at sha256sum -c; nothing installed

  So the checksum gate depends on errexit. The step's own set -euo pipefail provides it, and so does GitHub's default shell for a run: without shell:, so it holds twice over as written.

• The retry. --retry 5 --retry-all-errors --retry-delay 5 covers DNS and connection blips, the exit-6 failure the comment describes. curl writes the whole file before sha256sum -c runs, so a partial or retried download can't be unpacked unverified.

• The rest of the repo is unaffected. The pre-commit trivy-config hook's comment ("CI installs trivy v0.69.3 via the workflow step") still matches. ci.yml's separate Trivy scan uses aquasecurity/trivy-action, pinned by SHA, so this PR doesn't touch it.

• One go job under the heavy lock, with Go 1.26.10: go vet ./... and go test ./... pass (3 packages). The diff changes only a workflow file, so this just confirms the head is sound.

Non-blocking

• --retry-all-errors also retries HTTP errors such as a 404. A mistyped TRIVY_VERSION therefore costs about 25 seconds of retries before failing. That's harmless.
• The hash is trust-on-first-use from the release's checksums.txt. Aqua also publishes a cosign signature for that file. If you want provenance beyond pinning, verifying it once when bumping TRIVY_VERSION, and noting that in the comment, would cover it. It isn't needed for this PR.

Not merging.