Rueckbau des Workarounds von 00f5b89. Der Archiv-Download war noetig,
weil git fetch gegen die Forge crashte. Ursache war kein git-Bug, sondern
eine Kompromittierung ueber CVE-2026-59774: ein injizierter
packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper,
dessen Ausgabe upload-pack an einer Assertion sterben liess.
Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert
wieder. Details: Obsidian "Projekte/Hellion Forge/Forge Security-Incident
2026-08-15.md".
git fetch over HTTPS is broken on this Gitea instance since 2026-08-12:
`git upload-pack --stateless-rpc` aborts with
BUG("packfile_uris requires sideband-all") in upload-pack.c and dumps
core on every fetch. Every checkout therefore failed before the scan
started, which is why all security runs have been red since then.
Reproduced against every repo, from multiple clients, on git 2.52 and
2.55, and on Gitea 1.26.1 as well as 1.26.4. SSH, the web UI and the
API are unaffected — only the smart-HTTP pack transfer dies.
Semgrep and Trivy operate on the working tree and do not need history,
so the sources are pulled as a tar archive over plain HTTP. This sidesteps
upload-pack entirely. Revert to actions/checkout once the fetch path is
fixed upstream.
The trivy install script otherwise queries api.github.com unauthenticated
for the latest release tag. Self-hosted runners hit rate-limit quickly
when multiple workflows run in succession, leading to empty version
resolution and install failures.
Version pinned with renovate annotation so updates flow through Renovate.
act_runner v0.6.1 fails when 2 jobs in the same task chown the shared workspace in parallel. Sequential steps inside one job sidestep the issue.
Trivy step uses if: always() so both tools surface findings in a single run.
Two changes for noise reduction and per-repo control:
1. New optional input `semgrep-exclude-rules` (comma-separated rule
IDs). Lets a consumer skip rules that are context-specific false
positives (e.g. SQLi rules in a local-only plugin with SqlParameter-
bound values).
2. Semgrep now only fails the build on ERROR-severity findings.
WARNING-level rules still run for visibility but do not block.
Keeps the noise floor low while still surfacing concerns.
Both are opt-in for consumers, default behaviour stays scan-everything.
The Trivy GitHub Action wrapper does nested checkouts and auth-juggling
that breaks on Self-Hosted Gitea Actions: 'Failure - Main Checkout
install script' on the first HellionChat run. Switching to the
upstream install.sh + plain `trivy fs` invocation has a smaller
surface and removes the action-internal git clone dance entirely.
JonKazama-Hellion
renovate-bot