multiarch trivy

.gitea/workflows/vulnscan.yaml

@@ -1,12 +1,12 @@
 ---
-  name: Vulnerability Scan
+name: Vulnerability Scan
 
-  on:
+on:
   schedule:
     - cron: "0 14 * * *"
   workflow_dispatch:
 
-  jobs:
+jobs:
   scan:
     name: Daily Vulnerability Scan
     runs-on: ubuntu-latest
@@ -17,28 +17,22 @@
       - name: Pull docker image
         run: docker pull docker.asperti.com/paspo/smtp-relay:latest
 
-        - uses: actions/cache/restore@v4
-          with:
-            path: |
-              /root/.cache/trivy
-            key: trivy-db
-  
       - name: Setup trivy
         run: |
-            wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.57.1/trivy_0.57.1_Linux-64bit.deb
+          echo "Installing Trivy for arch: $(uname -m)"
+          case $(uname -m) in
+            x86_64)
+              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-64bit.deb ;;
+            aarch64)
+              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-ARM64.deb ;;
+            *) exit 1 ;;
+          esac
           dpkg -i /tmp/trivy.deb
 
       - name: Run Trivy vulnerability scanner
         id: scan
         run: |
-            trivy image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json
-  
-        - uses: actions/cache/save@v4
-          if: always()  # salva in cache anche se trova vulnerabilità
-          with:
-            path: |
-              /root/.cache/trivy
-            key: trivy-db
+          trivy --server ${{ secrets.TRIVY_SERVER }} --token ${{ secrets.TRIVY_TOKEN }} image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json
 
       # if some vulnerability is found, we fail
       - name: check output
@@ -56,4 +50,3 @@
           format: markdown
           message: |
             Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`
-