[P9] Fix trivy scan output not reaching S3 upload steps #104

New Issue

kert · 2026-03-22T16:42:35Z

kert commented

2026-03-22 16:42:35 +00:00

Problem

Trivy scan steps (plugin-trivy) write JSON output files (e.g. notebooks-scan.json) but the S3 upload steps report file does not exist. The trivy plugin likely writes to its own working directory rather than the shared Woodpecker workspace.

With the DinD buildx setup, buildx steps and trivy steps run in different contexts:

buildx runs inside DinD (insecure image)
trivy runs as a normal plugin container with Docker socket mount

The scan output file is written inside the trivy container but is not available to the S3 upload step.

Options

Switch trivy to commands-based step: docker run aquasec/trivy ... -o /woodpecker/src/.../scan.json
Use trivy plugin's workspace path if it supports it
Combine scan + upload into a single step
Mount a shared volume for scan artifacts

Acceptance criteria

Trivy scan JSON files are available to S3 upload steps
All 4 upload-*-scan steps pass
Scan results visible in S3 at s3://gitea/ci/homelab/stack/<sha>/

## Problem Trivy scan steps (plugin-trivy) write JSON output files (e.g. `notebooks-scan.json`) but the S3 upload steps report `file does not exist`. The trivy plugin likely writes to its own working directory rather than the shared Woodpecker workspace. With the DinD buildx setup, buildx steps and trivy steps run in different contexts: - buildx runs inside DinD (insecure image) - trivy runs as a normal plugin container with Docker socket mount The scan output file is written inside the trivy container but is not available to the S3 upload step. ## Options 1. Switch trivy to commands-based step: `docker run aquasec/trivy ... -o /woodpecker/src/.../scan.json` 2. Use trivy plugin's workspace path if it supports it 3. Combine scan + upload into a single step 4. Mount a shared volume for scan artifacts ## Acceptance criteria - [ ] Trivy scan JSON files are available to S3 upload steps - [ ] All 4 upload-*-scan steps pass - [ ] Scan results visible in S3 at `s3://gitea/ci/homelab/stack/<sha>/`

kert added this to the P9: CI/CD Unification milestone 2026-03-22 16:42:35 +00:00

kert added the ci label 2026-03-22 16:42:35 +00:00

kert referenced this issue from a commit

2026-03-22 16:50:18 +00:00

fix scan uploads, report-failure, add vuln issue reporter

kert closed this issue

2026-03-22 16:50:18 +00:00

Sign in to join this conversation.