From 1813546bee5b2d9a0a4df9fc7c3b1d93c27d0a16 Mon Sep 17 00:00:00 2001
From: devitway <devitway@gmail.com>
Date: Mon, 23 Feb 2026 16:15:03 +0000
Subject: [PATCH] ci: move trivy image scan to separate ubuntu-latest job to
 avoid self-hosted timeout

---
 .github/workflows/release.yml | 38 ++++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 95ac9fe..471eacd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      security-events: write  # for uploading SARIF to GitHub Security tab
 
     strategy:
       fail-fast: false
@@ -103,19 +102,44 @@ jobs:
           cache-from: type=gha,scope=${{ matrix.name }}
           cache-to: type=gha,mode=max,scope=${{ matrix.name }}
 
+  scan:
+    name: Scan (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    needs: build-docker
+    permissions:
+      contents: read
+      packages: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: alpine
+            suffix: ""
+          - name: astra
+            suffix: "-astra"
+          - name: redos
+            suffix: "-redos"
+
+    steps:
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       # ── CVE scan of the pushed image ────────────────────────────────────────
-      - name: Trivy — image scan
+      - name: Trivy — image scan (${{ matrix.name }})
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: image
-          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}${{ matrix.suffix }}
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}${{ matrix.suffix }}
           format: sarif
           output: trivy-image-${{ matrix.name }}.sarif
           severity: HIGH,CRITICAL
           exit-code: 0  # warn only; change to 1 to block on vulnerabilities
-        env:
-          TRIVY_USERNAME: ${{ github.actor }}
-          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy image results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
@@ -127,7 +151,7 @@ jobs:
   release:
     name: GitHub Release
     runs-on: ubuntu-latest
-    needs: build-docker
+    needs: [build-docker, scan]
     permissions:
       contents: write
       packages: read  # to pull image for SBOM generation