fix(ci): use ghcr.io mirror for Trivy DB to avoid mirror.gcr.io DNS failures

mirror.gcr.io intermittently fails DNS resolution in CI runner environment. Add --db-repository ghcr.io/aquasecurity/trivy-db to all three Trivy scan steps as a reliable alternative to the default GCR mirror. Fixes pipeline #1056 failure (security-trivy-api/orchestrator/web all failed with: 'dial tcp: lookup mirror.gcr.io on 127.0.0.11:53: server misbehaving')
Merge pull request 'feat(gatekeeper): add PR merge automation service with Gitea webhook integration' (#758 ) from feat/ms-gate-001-gatekeeper into main
2026-03-11 07:08:04 -05:00 · 2026-03-11 03:57:53 +00:00 · 2026-03-10 22:50:58 -05:00 · 2026-03-10 22:44:03 -05:00 · 2026-03-10 21:35:11 -05:00
2 changed files with 3 additions and 11 deletions
@@ -1,8 +0,0 @@
-{
-  "session_id": "codex-20260310-212234-510763",
-  "runtime": "codex",
-  "pid": 510763,
-  "started_at": "2026-03-11T02:22:34Z",
-  "project_path": "/home/jwoltje/src/mosaic-stack",
-  "milestone_id": ""
-}
@@ -243,7 +243,7 @@ steps:
        if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
        mkdir -p ~/.docker
        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-api:$$SCAN_TAG
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore --db-repository ghcr.io/aquasecurity/trivy-db git.mosaicstack.dev/mosaic/stack-api:$$SCAN_TAG
    when:
      - branch: [main]
        event: [push, manual, tag]
@@ -264,7 +264,7 @@ steps:
        if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
        mkdir -p ~/.docker
        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-orchestrator:$$SCAN_TAG
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore --db-repository ghcr.io/aquasecurity/trivy-db git.mosaicstack.dev/mosaic/stack-orchestrator:$$SCAN_TAG
    when:
      - branch: [main]
        event: [push, manual, tag]
@@ -305,7 +305,7 @@ steps:
        if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
        mkdir -p ~/.docker
        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-web:$$SCAN_TAG
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore --db-repository ghcr.io/aquasecurity/trivy-db git.mosaicstack.dev/mosaic/stack-web:$$SCAN_TAG
    when:
      - branch: [main]
        event: [push, manual, tag]
Author	SHA1	Message	Date
jason.woltje	d8a568d6c9	fix(ci): use ghcr.io mirror for Trivy DB to avoid mirror.gcr.io DNS failures mirror.gcr.io intermittently fails DNS resolution in CI runner environment. Add --db-repository ghcr.io/aquasecurity/trivy-db to all three Trivy scan steps as a reliable alternative to the default GCR mirror. Fixes pipeline #1056 failure (security-trivy-api/orchestrator/web all failed with: 'dial tcp: lookup mirror.gcr.io on 127.0.0.11:53: server misbehaving')	2026-03-11 07:08:04 -05:00
jason.woltje	97558c2817	Merge pull request 'feat(gatekeeper): add PR merge automation service with Gitea webhook integration' (#758 ) from feat/ms-gate-001-gatekeeper into main	2026-03-11 03:57:53 +00:00
jason.woltje	5f0a7c847c	fix: use double quotes for ConfigService key (prettier)	2026-03-10 22:50:58 -05:00
jason.woltjeandClaude Opus 4.6	639abfaefa	fix: bump simple-git to 3.32.3 and use ConfigService for giteaApiBaseUrl Co-Authored-By: Claude Opus 4.6 <[email protected]>	2026-03-10 22:44:03 -05:00
jason.woltje	6e2b9a307e	feat(gatekeeper): add PR merge automation service	2026-03-10 21:35:11 -05:00