From 51dcc4c01839238c6e1437a60de12b3a92c66365 Mon Sep 17 00:00:00 2001
From: gunshiz <spsshop1047@gmail.com>
Date: Tue, 22 Sep 2026 18:37:17 +0700
Subject: [PATCH] ci : fix

---
 .gitea/workflows/ci.yml | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5985512..4257f84 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -77,16 +77,18 @@ jobs:
             --tag "$REGISTRY_IMAGE:$REVISION" .
           docker build --target migration --build-arg VCS_REF="$REVISION" \
             --tag "$REGISTRY_IMAGE:migrate-$REVISION" .
-          mkdir -p "$RUNNER_TEMP/buzz-trivy-cache"
-          for tag in "$REVISION" "migrate-$REVISION"; do
-            docker save --output "$RUNNER_TEMP/buzz-image.tar" "$REGISTRY_IMAGE:$tag"
-            docker run --rm --user "$(id -u):$(id -g)" --cap-drop=ALL --security-opt=no-new-privileges \
-              --volume "$RUNNER_TEMP:/scan:ro" \
-              --volume "$RUNNER_TEMP/buzz-trivy-cache:/cache" \
-              aquasec/trivy@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c \
-              image --input /scan/buzz-image.tar --cache-dir /cache --scanners vuln --severity HIGH,CRITICAL --exit-code 1
-            rm "$RUNNER_TEMP/buzz-image.tar"
-          done
+          docker save --output "$RUNNER_TEMP/buzz-app-image.tar" "$REGISTRY_IMAGE:$REVISION"
+          docker save --output "$RUNNER_TEMP/buzz-migration-image.tar" "$REGISTRY_IMAGE:migrate-$REVISION"
+          chmod 644 "$RUNNER_TEMP/buzz-app-image.tar" "$RUNNER_TEMP/buzz-migration-image.tar"
+          # One scanner container shares its private cache across both images.
+          docker run --rm --user 0:0 --cap-drop=ALL --security-opt=no-new-privileges \
+            --volume "$RUNNER_TEMP/buzz-app-image.tar:/scan/buzz-app-image.tar:ro" \
+            --volume "$RUNNER_TEMP/buzz-migration-image.tar:/scan/buzz-migration-image.tar:ro" \
+            --entrypoint /bin/sh \
+            aquasec/trivy@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c \
+            -ec 'trivy image --input /scan/buzz-app-image.tar --cache-dir /tmp/trivy-cache --scanners vuln --severity HIGH,CRITICAL --exit-code 1 &&
+                 trivy image --input /scan/buzz-migration-image.tar --cache-dir /tmp/trivy-cache --scanners vuln --severity HIGH,CRITICAL --exit-code 1'
+          rm "$RUNNER_TEMP/buzz-app-image.tar" "$RUNNER_TEMP/buzz-migration-image.tar"
           docker push "$REGISTRY_IMAGE:$REVISION" | tee "$RUNNER_TEMP/buzz-app-push.log"
           docker push "$REGISTRY_IMAGE:migrate-$REVISION" | tee "$RUNNER_TEMP/buzz-migration-push.log"
       - name: Set up kubectl