From d6a30f3b2b6a23e6c40cd4003375f996cb5e02d0 Mon Sep 17 00:00:00 2001
From: Simon Axelsson <admin@siax.io>
Date: Wed, 11 Nov 2026 10:56:12 +0000
Subject: [PATCH] =?UTF-8?q?fix(ci):=20OSV-vakten=20och=20config-kollen=20k?=
 =?UTF-8?q?=C3=B6rs=20i=20scanvolymen?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Samma ändring som admin/siax-standard#608; bara OSV-steget byts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/security.yml | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 01961af..06db2fb 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -106,17 +106,34 @@ jobs:
 
       # Kanda sarbarheter i lasfilen. osv-scanner 2.x hittar inte alltid
       # osv-scanner.toml sjalv, sa den skickas explicit nar den finns.
+      # Lasfilsvakten och config-kollen kors i en container som monterar
+      # volymen (FALLA 3 ovan). Kan sjalva sokningen inte koras hoppas OSV
+      # INTE over - da avgor OSV:s egen exitkod, enligt samma policy som ovan.
       - name: OSV Scanner
         run: |
-          if ! find /repo -maxdepth 3 \( -name 'pnpm-lock.yaml' -o -name 'package-lock.json' \
-               -o -name 'yarn.lock' -o -name 'poetry.lock' -o -name 'Pipfile.lock' \
-               -o -name 'requirements.txt' -o -name 'go.sum' -o -name 'Cargo.lock' \
-               -o -name 'composer.lock' -o -name 'Gemfile.lock' \) -print -quit | grep -q .; then
+          set +e
+          lock=$(docker run --rm -v "$SCAN_VOLUME:/repo:ro" alpine:3.20 \
+            find /repo -path /repo/.git -prune -o -type f \( \
+              -name 'pnpm-lock.yaml' -o -name 'package-lock.json' -o -name 'yarn.lock' \
+              -o -name 'bun.lock' -o -name 'poetry.lock' -o -name 'Pipfile.lock' \
+              -o -name 'uv.lock' -o -name 'pdm.lock' -o -name '*requirements*.txt' \
+              -o -name 'go.mod' -o -name 'Cargo.lock' -o -name 'composer.lock' \
+              -o -name 'Gemfile.lock' \) -print -quit)
+          frc=$?
+          set -e
+          if [ $frc -ne 0 ]; then
+            echo "::warning::lasfilsvakten kunde inte koras i scanvolymen (rc=$frc) - OSV kors anda"
+          elif [ -z "$lock" ]; then
             echo "Inga lasfiler i repot - OSV-Scanner har inget att scanna."
             exit 0
+          else
+            echo "Lasfil i scanvolymen ${lock#/repo/} - OSV-Scanner kors"
           fi
           cfg=""
-          if [ -f "/repo/osv-scanner.toml" ]; then cfg="--config=/repo/osv-scanner.toml"; fi
+          if docker run --rm -v "$SCAN_VOLUME:/repo:ro" alpine:3.20 test -f /repo/osv-scanner.toml; then
+            cfg="--config=/repo/osv-scanner.toml"
+            echo "Anvander /repo/osv-scanner.toml for hela repot"
+          fi
           set +e
           docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
             ghcr.io/google/osv-scanner:v2.7.1 scan source --recursive $cfg /repo > /tmp/scan.log 2>&1
-- 
2.54.0