JonKazama-Hellion
c9a8000a84
The Trivy GitHub Action wrapper does nested checkouts and auth-juggling that breaks on Self-Hosted Gitea Actions: 'Failure - Main Checkout install script' on the first HellionChat run. Switching to the upstream install.sh + plain `trivy fs` invocation has a smaller surface and removes the action-internal git clone dance entirely.
security-workflows
Reusable Gitea Actions workflows for security scanning across Hellion repos. One central definition that all consumer repos call via a tiny stub.
Usage
In any consumer repo, add .gitea/workflows/security.yml:
name: Security
on:
push:
branches: [main, master]
pull_request:
schedule:
- cron: '0 6 * * 1' # weekly Monday 06:00 UTC
workflow_dispatch:
jobs:
scan:
uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
That is the entire stub. Five lines of jobs: plus the trigger config the consumer actually wants.
What runs
| Tool | What it does |
|---|---|
| Semgrep (auto-config) | SAST scanning for common vulnerability patterns across C#, JavaScript, TypeScript, Python, Go and more. Pulls language-appropriate rule packs from semgrep.dev. |
| Trivy (filesystem scan) | Dependency vulnerability scanning against the NVD CVE database. Picks up NuGet *.csproj, npm package.json/package-lock.json, Dockerfiles and more. |
Both jobs run in parallel. Either failing fails the calling workflow.
Tuning per consumer
The reusable workflow accepts two optional inputs:
jobs:
scan:
uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
with:
severity: 'CRITICAL' # default 'CRITICAL,HIGH'
semgrep-config: 'p/owasp-top-ten' # default 'auto'
severity is the Trivy threshold, semgrep-config swaps the rule pack (e.g. p/owasp-top-ten, p/javascript, p/csharp).
Pinning
Consumers reference @main for rolling updates. To pin a specific commit, use the SHA: @<sha>. There are no tagged releases yet, the workflow API is intentionally minimal so breaking changes should be rare.