fix trivy

.drone.star

@@ -1,7 +1,7 @@
 def main(ctx):
     archs = ["amd64", "arm64"]   ## arm
-    glpi_version = "10.0.11"
-    alpine_version = "3.19"
+    glpi_version = "10.0.17"
+    alpine_version = "3.20"
 
     out = []
     for arch in archs:

.gitea/workflows/vulnscan.yaml

@@ -1,3 +1,4 @@
+---
 name: Vulnerability Scan
 
 on:
@@ -16,14 +17,36 @@ jobs:
       - name: Pull docker image
         run: docker pull docker.asperti.com/paspo/glpi:latest
 
+      - name: Setup trivy
+        run: |
+          echo "Installing Trivy for arch: $(uname -m)"
+          case $(uname -m) in
+            x86_64)
+              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-64bit.deb ;;
+            aarch64)
+              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-ARM64.deb ;;
+            *) exit 1 ;;
+          esac
+          dpkg -i /tmp/trivy.deb
+
       - name: Run Trivy vulnerability scanner
         id: scan
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: "docker.asperti.com/paspo/glpi:latest"
-          format: "json"
-          output: "trivy-results.json"
+        run: |
+          trivy --server ${{ secrets.TRIVY_SERVER }} --token ${{ secrets.TRIVY_TOKEN }} image --format json docker.asperti.com/paspo/glpi:latest > trivy-results.json
 
       # if some vulnerability is found, we fail
       - name: check output
-        run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
+        id: vulncount
+        run: |
+          echo "VULNCOUNT=$(jq '.Results[0].Vulnerabilities|length' trivy-results.json)" >> ${GITHUB_OUTPUT}
+          if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
+
+      - name: send telegram notification
+        if: failure()
+        uses: appleboy/telegram-action@master
+        with:
+          to: ${{ secrets.TELEGRAM_TO }}
+          token: ${{ secrets.TELEGRAM_TOKEN }}
+          format: markdown
+          message: |
+            Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`

src/Dockerfile

@@ -5,10 +5,10 @@ ARG GLPI_VERSION
 RUN \
   mkdir -p /logs /config /files /marketplace && \
   apk -U upgrade && \
-  apk add --no-cache curl nginx php82 php82-bz2 php82-ctype php82-curl php82-dom php82-exif \
-    php82-fileinfo php82-fpm php82-gd php82-iconv php82-intl php82-ldap php82-mysqli \
-    php82-opcache php82-openssl php82-pecl-apcu php82-pecl-redis php82-phar php82-session \
-    php82-simplexml php82-sodium php82-tokenizer php82-xml php82-zip php82-xmlreader php82-xmlwriter && \
+  apk add --no-cache curl nginx php83 php83-bz2 php83-ctype php83-curl php83-dom php83-exif \
+    php83-fileinfo php83-fpm php83-gd php83-iconv php83-intl php83-ldap php83-mysqli \
+    php83-opcache php83-openssl php83-pecl-apcu php83-pecl-redis php83-phar php83-session \
+    php83-simplexml php83-sodium php83-tokenizer php83-xml php83-zip php83-xmlreader php83-xmlwriter && \
   wget -O /usr/local/bin/composer https://getcomposer.org/download/2.5.8/composer.phar && \
   chmod +x /usr/local/bin/composer && \
   wget -O - https://github.com/glpi-project/glpi/releases/download/${GLPI_VERSION}/glpi-${GLPI_VERSION}.tgz | tar xz -C /var/www