From 0a69327a490ed30847c42bac1e60c43fe36b9adb Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Mon, 13 Jul 2026 08:37:12 -0400 Subject: [PATCH] fix(reusable-trivy): authenticate to GHCR before scanning image-ref The `image` job scans `image-ref` by digest directly from the registry, but never logs in first. Trivy's image-source resolution tries docker/containerd/podman/remote in order; all four fail on a runner with no local copy of the image, including the remote pull ("UNAUTHORIZED: authentication required") since it has no credentials. Add the same docker/login-action step sign-and-attest.yml already uses for the identical registry. Confirmed on go-htmx's v0.1.1 release run: gate-image/image failed with exactly this error immediately after docker-sign/docker-verify both succeeded against the same image digest. --- .github/workflows/reusable-trivy.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/reusable-trivy.yml b/.github/workflows/reusable-trivy.yml index 11d50c2..8e5ee8d 100644 --- a/.github/workflows/reusable-trivy.yml +++ b/.github/workflows/reusable-trivy.yml @@ -111,6 +111,19 @@ jobs: actions: read packages: read steps: + # image-ref is scanned by digest from the registry (not a local + # docker/containerd/podman image), so Trivy needs an authenticated + # pull — without this, all four of its image-source backends fail, + # including the remote one ("UNAUTHORIZED: authentication required"), + # even for a public GHCR package. Matches sign-and-attest.yml's + # identical login step for the same registry. + - name: Log in to GHCR + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Trivy image vulnerability scan uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: