Skip to content

Commit 3b94de4

Browse files
Soju06Soju06
committed
fix(ci): lowercase Trivy image-ref and bump all actions to latest
Trivy fails to parse uppercase image references (Soju06 → soju06). Compute lowercased ref in a prior step, same pattern as the Helm push fix. Action bumps: - docker/setup-buildx-action v3 → v4 - docker/setup-qemu-action v3 → v4 - docker/login-action v3 → v4 - docker/metadata-action v5 → v6 - docker/build-push-action v6 → v7 - github/codeql-action v3 → v4 - oven-sh/setup-bun v2.1.3 → v2 (floating major) - astral-sh/setup-uv v7.5.0 → v8
1 parent 56e2708 commit 3b94de4

2 files changed

Lines changed: 29 additions & 25 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
uses: actions/checkout@v6.0.2
2020

2121
- name: Set up Bun
22-
uses: oven-sh/setup-bun@v2.1.3
22+
uses: oven-sh/setup-bun@v2
2323
with:
2424
bun-version: "1.3.10"
2525

@@ -38,7 +38,7 @@ jobs:
3838
uses: actions/checkout@v6.0.2
3939

4040
- name: Set up Bun
41-
uses: oven-sh/setup-bun@v2.1.3
41+
uses: oven-sh/setup-bun@v2
4242
with:
4343
bun-version: "1.3.10"
4444

@@ -57,7 +57,7 @@ jobs:
5757
uses: actions/checkout@v6.0.2
5858

5959
- name: Set up Bun
60-
uses: oven-sh/setup-bun@v2.1.3
60+
uses: oven-sh/setup-bun@v2
6161
with:
6262
bun-version: "1.3.10"
6363

@@ -76,7 +76,7 @@ jobs:
7676
uses: actions/checkout@v6.0.2
7777

7878
- name: Set up Bun
79-
uses: oven-sh/setup-bun@v2.1.3
79+
uses: oven-sh/setup-bun@v2
8080
with:
8181
bun-version: "1.3.10"
8282

@@ -95,7 +95,7 @@ jobs:
9595
uses: actions/checkout@v6.0.2
9696

9797
- name: Set up uv
98-
uses: astral-sh/setup-uv@v7.5.0
98+
uses: astral-sh/setup-uv@v8
9999
with:
100100
python-version: "3.13"
101101
enable-cache: true
@@ -115,7 +115,7 @@ jobs:
115115
uses: actions/checkout@v6.0.2
116116

117117
- name: Set up uv
118-
uses: astral-sh/setup-uv@v7.5.0
118+
uses: astral-sh/setup-uv@v8
119119
with:
120120
python-version: "3.13"
121121
enable-cache: true
@@ -135,7 +135,7 @@ jobs:
135135
uses: actions/checkout@v6.0.2
136136

137137
- name: Set up Bun
138-
uses: oven-sh/setup-bun@v2.1.3
138+
uses: oven-sh/setup-bun@v2
139139
with:
140140
bun-version: "1.3.10"
141141

@@ -146,7 +146,7 @@ jobs:
146146
run: cd frontend && bun run build
147147

148148
- name: Set up uv
149-
uses: astral-sh/setup-uv@v7.5.0
149+
uses: astral-sh/setup-uv@v8
150150
with:
151151
python-version: "3.13"
152152
enable-cache: true
@@ -182,7 +182,7 @@ jobs:
182182
uses: actions/checkout@v6.0.2
183183

184184
- name: Set up Bun
185-
uses: oven-sh/setup-bun@v2.1.3
185+
uses: oven-sh/setup-bun@v2
186186
with:
187187
bun-version: "1.3.10"
188188

@@ -193,7 +193,7 @@ jobs:
193193
run: cd frontend && bun run build
194194

195195
- name: Set up uv
196-
uses: astral-sh/setup-uv@v7.5.0
196+
uses: astral-sh/setup-uv@v8
197197
with:
198198
python-version: "3.13"
199199
enable-cache: true
@@ -213,7 +213,7 @@ jobs:
213213
uses: actions/checkout@v6.0.2
214214

215215
- name: Set up uv
216-
uses: astral-sh/setup-uv@v7.5.0
216+
uses: astral-sh/setup-uv@v8
217217
with:
218218
python-version: "3.13"
219219
enable-cache: true
@@ -253,7 +253,7 @@ jobs:
253253
uses: actions/checkout@v6.0.2
254254

255255
- name: Set up uv
256-
uses: astral-sh/setup-uv@v7.5.0
256+
uses: astral-sh/setup-uv@v8
257257
with:
258258
python-version: "3.13"
259259
enable-cache: true
@@ -278,7 +278,7 @@ jobs:
278278
uses: actions/checkout@v6.0.2
279279

280280
- name: Set up Bun
281-
uses: oven-sh/setup-bun@v2.1.3
281+
uses: oven-sh/setup-bun@v2
282282
with:
283283
bun-version: "1.3.10"
284284

@@ -289,7 +289,7 @@ jobs:
289289
run: cd frontend && bun run build
290290

291291
- name: Set up uv
292-
uses: astral-sh/setup-uv@v7.5.0
292+
uses: astral-sh/setup-uv@v8
293293
with:
294294
python-version: "3.13"
295295
enable-cache: true
@@ -337,10 +337,10 @@ jobs:
337337
uses: actions/checkout@v6.0.2
338338

339339
- name: Set up Docker Buildx
340-
uses: docker/setup-buildx-action@v3
340+
uses: docker/setup-buildx-action@v4
341341

342342
- name: Build Docker image
343-
uses: docker/build-push-action@v6
343+
uses: docker/build-push-action@v7
344344
with:
345345
context: .
346346
file: Dockerfile

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
ref: ${{ env.RELEASE_TAG }}
3030

3131
- name: Set up Bun
32-
uses: oven-sh/setup-bun@v2.1.3
32+
uses: oven-sh/setup-bun@v2
3333
with:
3434
bun-version: "1.3.10"
3535

@@ -40,7 +40,7 @@ jobs:
4040
run: cd frontend && bun run build
4141

4242
- name: Set up uv
43-
uses: astral-sh/setup-uv@v7.5.0
43+
uses: astral-sh/setup-uv@v8
4444
with:
4545
python-version: "3.13"
4646
enable-cache: true
@@ -155,21 +155,21 @@ jobs:
155155
ref: ${{ env.RELEASE_TAG }}
156156

157157
- name: Set up Docker Buildx
158-
uses: docker/setup-buildx-action@v3
158+
uses: docker/setup-buildx-action@v4
159159

160160
- name: Set up QEMU
161-
uses: docker/setup-qemu-action@v3
161+
uses: docker/setup-qemu-action@v4
162162

163163
- name: Log in to GHCR
164-
uses: docker/login-action@v3
164+
uses: docker/login-action@v4
165165
with:
166166
registry: ghcr.io
167167
username: ${{ github.actor }}
168168
password: ${{ secrets.GITHUB_TOKEN }}
169169

170170
- name: Extract Docker metadata
171171
id: meta
172-
uses: docker/metadata-action@v5
172+
uses: docker/metadata-action@v6
173173
with:
174174
images: ghcr.io/${{ github.repository }}
175175
tags: |
@@ -179,7 +179,7 @@ jobs:
179179
type=raw,value=latest
180180
181181
- name: Build and push Docker image
182-
uses: docker/build-push-action@v6
182+
uses: docker/build-push-action@v7
183183
with:
184184
context: .
185185
file: Dockerfile
@@ -190,17 +190,21 @@ jobs:
190190
cache-from: type=gha
191191
cache-to: type=gha,mode=max
192192

193+
- name: Set lowercase image ref
194+
id: image
195+
run: echo "ref=ghcr.io/${GITHUB_REPOSITORY,,}:${{ steps.meta.outputs.version }}" >> "$GITHUB_OUTPUT"
196+
193197
- name: Scan Docker image with Trivy (SARIF)
194198
uses: aquasecurity/trivy-action@0.35.0
195199
with:
196-
image-ref: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}
200+
image-ref: ${{ steps.image.outputs.ref }}
197201
format: sarif
198202
output: trivy-results.sarif
199203
severity: CRITICAL,HIGH
200204
ignore-unfixed: true
201205

202206
- name: Upload Trivy scan results to GitHub Security
203-
uses: github/codeql-action/upload-sarif@v3
207+
uses: github/codeql-action/upload-sarif@v4
204208
if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
205209
with:
206210
sarif_file: trivy-results.sarif

0 commit comments

Comments
 (0)