.gitea/workflows/security.yml

@@ -106,17 +106,34 @@ jobs:
 
       # Kanda sarbarheter i lasfilen. osv-scanner 2.x hittar inte alltid
       # osv-scanner.toml sjalv, sa den skickas explicit nar den finns.
+      # Lasfilsvakten och config-kollen kors i en container som monterar
+      # volymen (FALLA 3 ovan). Kan sjalva sokningen inte koras hoppas OSV
+      # INTE over - da avgor OSV:s egen exitkod, enligt samma policy som ovan.
       - name: OSV Scanner
         run: |
-          if ! find /repo -maxdepth 3 \( -name 'pnpm-lock.yaml' -o -name 'package-lock.json' \
-               -o -name 'yarn.lock' -o -name 'poetry.lock' -o -name 'Pipfile.lock' \
-               -o -name 'requirements.txt' -o -name 'go.sum' -o -name 'Cargo.lock' \
-               -o -name 'composer.lock' -o -name 'Gemfile.lock' \) -print -quit | grep -q .; then
+          set +e
+          lock=$(docker run --rm -v "$SCAN_VOLUME:/repo:ro" alpine:3.20 \
+            find /repo -path /repo/.git -prune -o -type f \( \
+              -name 'pnpm-lock.yaml' -o -name 'package-lock.json' -o -name 'yarn.lock' \
+              -o -name 'bun.lock' -o -name 'poetry.lock' -o -name 'Pipfile.lock' \
+              -o -name 'uv.lock' -o -name 'pdm.lock' -o -name '*requirements*.txt' \
+              -o -name 'go.mod' -o -name 'Cargo.lock' -o -name 'composer.lock' \
+              -o -name 'Gemfile.lock' \) -print -quit)
+          frc=$?
+          set -e
+          if [ $frc -ne 0 ]; then
+            echo "::warning::lasfilsvakten kunde inte koras i scanvolymen (rc=$frc) - OSV kors anda"
+          elif [ -z "$lock" ]; then
             echo "Inga lasfiler i repot - OSV-Scanner har inget att scanna."
             exit 0
+          else
+            echo "Lasfil i scanvolymen ${lock#/repo/} - OSV-Scanner kors"
           fi
           cfg=""
-          if [ -f "/repo/osv-scanner.toml" ]; then cfg="--config=/repo/osv-scanner.toml"; fi
+          if docker run --rm -v "$SCAN_VOLUME:/repo:ro" alpine:3.20 test -f /repo/osv-scanner.toml; then
+            cfg="--config=/repo/osv-scanner.toml"
+            echo "Anvander /repo/osv-scanner.toml for hela repot"
+          fi
           set +e
           docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
             ghcr.io/google/osv-scanner:v2.7.1 scan source --recursive $cfg /repo > /tmp/scan.log 2>&1