From fd8e5a1a17ba52f4aee5c915791a7da061958123 Mon Sep 17 00:00:00 2001
From: Jon Kazama <1+jonkazama-hellion@noreply.gitea.hellion-forge.cloud>
Date: Sat, 15 Aug 2026 21:17:43 +0000
Subject: [PATCH] revert(ci): security-scan wieder ueber den reusable workflow

Rueckbau des Inline-Workarounds. Der Runner konnte den reusable workflow
nicht mehr laden, weil git fetch gegen die Forge crashte. Ursache war kein
Bug, sondern eine Kompromittierung ueber CVE-2026-59774: ein injizierter
packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper.

Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert
wieder. Die Scan-Definition liegt damit wieder an einer Stelle statt in
sieben Dateien. Details: Obsidian "Projekte/Hellion Forge/Forge
Security-Incident 2026-08-15.md".
---
 .gitea/workflows/security.yml | 77 ++++-------------------------------
 1 file changed, 7 insertions(+), 70 deletions(-)

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 2c95d47..b37901a 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -1,20 +1,7 @@
 name: Security
 
-# Self-contained security scan: Semgrep SAST + Trivy filesystem scan.
-#
-# Deliberately NOT calling the reusable workflow in security-workflows:
-# act_runner fetches reusable workflows by cloning them over HTTPS, and git
-# fetch over HTTPS is broken on this Gitea instance since 2026-08-12
-# (`git upload-pack --stateless-rpc` aborts with
-# BUG("packfile_uris requires sideband-all") and dumps core). The runner only
-# kept working because it still had a June copy in its action cache. Inlining
-# removes that dependency entirely.
-#
-# For the same reason the sources are pulled as a tar archive instead of via
-# actions/checkout. Restore the reusable call once the fetch path is fixed.
-#
-# Why one job, not two parallel jobs: act_runner v0.6.1 has a race when two
-# jobs in the same task share a workspace and chown it in parallel.
+# Ruft den zentralen Scan-Workflow in security-workflows auf
+# (Semgrep SAST + Trivy filesystem scan).
 
 on:
   push:
@@ -24,60 +11,10 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
-env:
-  TRIVY_SEVERITY: 'CRITICAL,HIGH'
-  # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind;
-  # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht.
-  SEMGREP_EXCLUDE_RULES: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'
-
 jobs:
   scan:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout sources
-        env:
-          TOKEN: ${{ github.token }}
-          # On pull_request the merge SHA may not be archivable, use the head.
-          REF: ${{ github.event.pull_request.head.sha || github.sha }}
-          SERVER: ${{ github.server_url }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -eu
-          echo "Fetching archive for $REPO @ $REF"
-          curl -sfL --retry 3 --retry-delay 5 \
-            -H "Authorization: token $TOKEN" \
-            "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz
-          tar xzf /tmp/source.tar.gz --strip-components=1
-          rm -f /tmp/source.tar.gz
-          echo "Extracted $(find . -type f | wc -l) files"
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.x'
-
-      - name: Install Semgrep
-        run: pip install --no-cache-dir semgrep
-
-      - name: Install Trivy
-        # Version pinned so the install script does not hit api.github.com to
-        # resolve "latest", which burns the runner's unauthenticated rate limit.
-        # renovate: datasource=github-releases depName=aquasecurity/trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.70.0
-
-      - name: Run Semgrep SAST
-        run: |
-          args="--config=auto --error --severity=ERROR"
-          if [ -n "$SEMGREP_EXCLUDE_RULES" ]; then
-            for rule in $(echo "$SEMGREP_EXCLUDE_RULES" | tr ',' ' '); do
-              args="$args --exclude-rule=$rule"
-            done
-          fi
-          echo "Running: semgrep scan $args"
-          semgrep scan $args
-
-      - name: Run Trivy filesystem scan
-        # if: always() — surface Trivy findings even when Semgrep fails first.
-        if: always()
-        run: trivy fs --severity "$TRIVY_SEVERITY" --exit-code 1 --ignore-unfixed .
+    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
+    with:
+      # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind;
+      # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht.
+      semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'