fix trivy vulnerability DB update outage

.gitea/workflows/docker-publish.yml

@@ -57,14 +57,14 @@ env:
   BUILDX_VERSION: "0.35.0"
   BUILDX_SHA256: "d41ece72044243b4f58b343441ae37446d9c29a7d6b5e11c61847bbcf8f7dfda"
   BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
-  TRIVY_VERSION: "0.71.0"
+  TRIVY_VERSION: "0.72.0"
-  TRIVY_SHA256: "30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814"
+  TRIVY_SHA256: "bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea"
 
 jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -180,11 +180,35 @@ jobs:
           fi
           trivy --version
 
+          # Trivy's default vulnerability-DB source (mirror.gcr.io/aquasec/trivy-db) is a
+          # Google-hosted cache of the upstream GHCR image, used to dodge GHCR's unauthenticated
+          # rate limits. That cache occasionally 404s on a specific layer digest (a known,
+          # recurring upstream issue: aquasecurity/trivy). Point at the canonical GHCR source
+          # instead, and retry the DB download alone a few times — trivy exits 1 both for "DB
+          # download failed" and for "vulnerabilities found", so the download is a separate step
+          # from the scan to keep those two outcomes distinguishable.
+          export TRIVY_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-db:2"
+          export TRIVY_JAVA_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-java-db:1"
+
+          echo "=== Ensuring vulnerability DB is up to date ==="
+          db_attempt=1
+          db_max_attempts=3
+          until trivy image --download-db-only; do
+            if [ "$db_attempt" -ge "$db_max_attempts" ]; then
+              echo "=== Failed to download the Trivy vulnerability DB after ${db_max_attempts} attempts ==="
+              exit 1
+            fi
+            echo "=== DB download failed, retrying (${db_attempt}/${db_max_attempts})... ==="
+            db_attempt=$((db_attempt + 1))
+            sleep $((db_attempt * 5))
+          done
+
           echo "=== Scanning ${{ steps.vars.outputs.scan_ref }} (fail on fixable ${{ inputs.scan_severity }}) ==="
           trivy image \
             --exit-code 1 \
             --severity "${{ inputs.scan_severity }}" \
             --ignore-unfixed \
+            --skip-db-update \
             --scanners vuln,secret \
             "${{ steps.vars.outputs.scan_ref }}"
 

.gitea/workflows/image-security-checks.yml

@@ -21,7 +21,7 @@ jobs:
   scan:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -48,8 +48,8 @@ jobs:
           # checksum, never "latest": Trivy releases were compromised in the
           # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
           # with the ARGs in the PipelineImage Dockerfiles.
-          TRIVY_VERSION=0.71.0
+          TRIVY_VERSION=0.72.0
-          TRIVY_SHA256=30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814
+          TRIVY_SHA256=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
           if ! command -v trivy >/dev/null 2>&1; then
             echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
             curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -61,10 +61,34 @@ jobs:
 
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}:${{ inputs.image_tag }}"
 
+          # Trivy's default vulnerability-DB source (mirror.gcr.io/aquasec/trivy-db) is a
+          # Google-hosted cache of the upstream GHCR image, used to dodge GHCR's unauthenticated
+          # rate limits. That cache occasionally 404s on a specific layer digest (a known,
+          # recurring upstream issue: aquasecurity/trivy). Point at the canonical GHCR source
+          # instead, and retry the DB download alone a few times — trivy exits 1 both for "DB
+          # download failed" and for "vulnerabilities found", so the download is a separate step
+          # from the scan to keep those two outcomes distinguishable.
+          export TRIVY_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-db:2"
+          export TRIVY_JAVA_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-java-db:1"
+
+          echo "=== Ensuring vulnerability DB is up to date ==="
+          db_attempt=1
+          db_max_attempts=3
+          until trivy image --download-db-only; do
+            if [ "$db_attempt" -ge "$db_max_attempts" ]; then
+              echo "=== Failed to download the Trivy vulnerability DB after ${db_max_attempts} attempts ==="
+              exit 1
+            fi
+            echo "=== DB download failed, retrying (${db_attempt}/${db_max_attempts})... ==="
+            db_attempt=$((db_attempt + 1))
+            sleep $((db_attempt * 5))
+          done
+
           echo "=== Scanning ${FULL_IMAGE} (fail on fixable ${{ inputs.scan_severity }}) ==="
           trivy image \
             --exit-code 1 \
             --severity "${{ inputs.scan_severity }}" \
             --ignore-unfixed \
+            --skip-db-update \
             --scanners vuln,secret \
             "${FULL_IMAGE}"

.gitea/workflows/python-checks.yml

@@ -29,7 +29,7 @@ jobs:
   check:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}

.gitea/workflows/python-package-publish.yml

@@ -30,7 +30,7 @@ jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}

.gitea/workflows/python-security-checks.yml

@@ -20,7 +20,7 @@ jobs:
   security:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}