From cc7bf90891788cca330648e47e2fa6d72142bb57 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Wed, 4 Nov 2026 03:56:58 +0100 Subject: [PATCH] ci(pre-commit): install Trivy from the pinned, checksummed release tarball install.sh made a second, unretried download that failed on runner DNS blips (curl exit 6). Fetch the v0.69.3 tarball with retries, verify its pinned sha256, then unpack. Same step as LeanerCloud/cloud-commitments-go#669. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pre-commit.yml | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index db6ac6e..57ea130 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -72,27 +72,21 @@ jobs: run: go install github.com/fzipp/gocyclo/cmd/gocyclo@v0.6.0 - name: Install Trivy - # Pinned to v0.69.3 (the latest release with published GitHub-release - # tarballs as of writing). Tags exist for v0.58 onwards but several - # mid-range releases skipped publishing assets to the Releases page; - # the install.sh script fetches via GitHub Releases, so picking one - # of those tags makes install bail silently after detecting the - # version. v0.69.3 ships the standard `trivy__Linux-64bit.tar.gz` - # asset. - # - # The installer itself is fetched from the same pinned release tag - # (not the mutable `main` branch) and downloaded to a file before - # execution: a malicious or - # accidental change to install.sh on main can't silently execute - # on this CI runner, and `curl -fsSL` makes transport errors fail - # loudly instead of piping an HTML error page into sh. + # Pinned release tarball, verified against a pinned sha256 (from the + # release's checksums.txt) before it is unpacked. install.sh made a + # second, unretried download that failed on runner DNS blips (exit 6); + # curl --retry-all-errors rides those out. Same step as + # LeanerCloud/cloud-commitments-go#669. env: TRIVY_VERSION: v0.69.3 + TRIVY_SHA256: 1816b632dfe529869c740c0913e36bd1629cb7688bd5634f4a858c1d57c88b75 run: | set -euo pipefail - curl -fsSL -o /tmp/trivy-install.sh \ - "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" - sh /tmp/trivy-install.sh -b /usr/local/bin "${TRIVY_VERSION}" + curl -fsSL --retry 5 --retry-all-errors --retry-delay 5 -o "$RUNNER_TEMP/trivy.tgz" \ + "https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/trivy_${TRIVY_VERSION#v}_Linux-64bit.tar.gz" + echo "${TRIVY_SHA256} $RUNNER_TEMP/trivy.tgz" | sha256sum -c - + tar -xzf "$RUNNER_TEMP/trivy.tgz" -C /usr/local/bin trivy + trivy --version - name: Install git-secrets # Pinned to a release tag rather than master HEAD. The tag is