From 2abed856c2a20ed455263d2232434678306ed46b Mon Sep 17 00:00:00 2001 From: Seppelflink Date: Fri, 31 Jul 2026 18:37:09 +0200 Subject: [PATCH 1/4] Fix: use paths-ignore instead of negation in guard-skills workflow Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/guard-skills.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/guard-skills.yml b/.github/workflows/guard-skills.yml index a9e9f419..50fad95e 100644 --- a/.github/workflows/guard-skills.yml +++ b/.github/workflows/guard-skills.yml @@ -4,11 +4,12 @@ on: pull_request: paths: - 'skills/**' - - '!skills/README.md' - 'providers/claude/plugin/skills/**' - 'providers/codex/plugin/skills/**' - 'providers/cursor/plugin/skills/**' - 'providers/grok/plugin/skills/**' + paths-ignore: + - 'skills/README.md' jobs: block: From e6f7135a14f497a64cf12c5c1a158ba04cbf42e9 Mon Sep 17 00:00:00 2001 From: Copilot App <223556219+Copilot@users.noreply.github.com> Date: Fri, 31 Jul 2026 19:04:48 +0200 Subject: [PATCH 2/4] Test: trigger guard-skills workflow --- skills/test-trigger.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 skills/test-trigger.txt diff --git a/skills/test-trigger.txt b/skills/test-trigger.txt new file mode 100644 index 00000000..fb39ec48 --- /dev/null +++ b/skills/test-trigger.txt @@ -0,0 +1 @@ +This is a test to trigger guard-skills workflow. Please ignore. From 97b501a2c1a68dbb814281b8c78541b13d6a2876 Mon Sep 17 00:00:00 2001 From: Seppelflink Date: Sun, 2 Aug 2026 05:26:19 +0200 Subject: [PATCH 3/4] chore: hermes retrigger empty commit at 2026-08-02T05:26:19.0338301+02:00 From 946059dbb5be1c466279b515ec05126dddee1803 Mon Sep 17 00:00:00 2001 From: Seppelflink Date: Sun, 2 Aug 2026 17:40:58 +0200 Subject: [PATCH 4/4] ci: add Trivy scan workflow and docs\n\nAdd a GitHub Actions job to run Trivy filesystem scans on pushes to main and on pull requests.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/trivy-scan.yml | 29 +++++++++++++++++++++++++++++ docs/trivy-integration.md | 16 ++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 .github/workflows/trivy-scan.yml create mode 100644 docs/trivy-integration.md diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml new file mode 100644 index 00000000..883d9c82 --- /dev/null +++ b/.github/workflows/trivy-scan.yml @@ -0,0 +1,29 @@ +name: Trivy security scan + +on: + push: + branches: [ main ] + pull_request: + types: [opened, synchronize, reopened] + +jobs: + trivy-scan: + name: Trivy filesystem scan + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Run Trivy filesystem scan + uses: aquasecurity/trivy-action@v0.2.0 + with: + scan-type: fs + format: table + severity: CRITICAL,HIGH,MEDIUM + + - name: Show summary (always) + if: always() + run: | + echo "Trivy step finished. Check the job log for details." diff --git a/docs/trivy-integration.md b/docs/trivy-integration.md new file mode 100644 index 00000000..e15d2173 --- /dev/null +++ b/docs/trivy-integration.md @@ -0,0 +1,16 @@ +Trivy integration (quick start) + +This repository now includes a GitHub Actions job (.github/workflows/trivy-scan.yml) that runs Trivy filesystem scans on pushes to main and on pull requests. + +Run locally (Docker): + +- Scan the repo directory and produce a table report: + docker run --rm -v "$(pwd)":/project aquasecurity/trivy:latest fs --severity CRITICAL,HIGH,MEDIUM -f table /project + +- Output JSON for further processing: + docker run --rm -v "$(pwd)":/project aquasecurity/trivy:latest fs --severity CRITICAL,HIGH,MEDIUM -f json -o /project/trivy-report.json /project + +CI notes: +- The action used is aquasecurity/trivy-action; check job logs for scan output. +- Adjust 'severity' in .github/workflows/trivy-scan.yml to change which severities trigger reporting. +- For faster scans in CI, consider caching or targetting only changed files/directories.