From 2d3cd7a8195995fe353dadceb577ecd7fa563016 Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Fri, 1 May 2026 10:45:53 +0200
Subject: [PATCH] fix(security-scan): unblock agent step + harden trivy image
 scans
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pipeline 850 reproduced two distinct failures:

1. image-scans died — Apache Tika hit Trivy's default 5-minute
   `context deadline exceeded`, and goauthentik/server's 30MB
   msgraph kiota-dom-export.txt blew the secret scanner's memory
   budget (Trivy itself warned about it).

2. security-fix-agent was skipped despite `failure: ignore` on
   image-scans. Woodpecker's `failure: ignore` only affects
   *workflow* status — downstream steps still gate on the
   previous step's exit, defaulting to status: [success].

Fixes:

- `--timeout 15m` and `--scanners vuln` on per-image trivy calls.
  We only care about CVEs (CRITICAL/HIGH, with FixedVersion) — the
  secret scanner was the OOM culprit and adds no value for our
  agent's decision rules.
- `when: status: [success, failure]` on security-fix-agent so it
  always runs, regardless of which scans crashed. The step's own
  gating logic already handles missing/empty JSON files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .woodpecker/security-scan.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.woodpecker/security-scan.yml b/.woodpecker/security-scan.yml
index 605bc6d5..2b3d39eb 100644
--- a/.woodpecker/security-scan.yml
+++ b/.woodpecker/security-scan.yml
@@ -32,7 +32,7 @@ steps:
           i=$$((i+1))
           out="trivy-image-$$i.json"
           echo "=== [$$i] $$img -> $$out ==="
-          trivy image --skip-db-update --severity CRITICAL,HIGH --ignore-unfixed --format json -o "$$out" "$$img" || true
+          trivy image --skip-db-update --scanners vuln --timeout 15m --severity CRITICAL,HIGH --ignore-unfixed --format json -o "$$out" "$$img" || true
         done < /tmp/images.txt
     failure: ignore
 
@@ -40,8 +40,16 @@ steps:
     # Auto-fix run: only on master (cron / manual / direct push). On the
     # bot's own PR branches, the scans re-run as a re-validation gate but
     # this step is skipped — otherwise we'd fork-bomb PRs.
+    #
+    # status: [success, failure] is required: image-scans has
+    # `failure: ignore` to avoid failing the workflow on a single
+    # bad image, but Woodpecker still skips downstream steps after
+    # a failed step unless they explicitly opt in. The agent's gating
+    # logic handles missing/empty JSON files gracefully — better to
+    # always reach the gate than silently skip on a flaky scan.
     when:
       - branch: master
+        status: [success, failure]
     image: gitea.renner.uno/gitea_admin/ci-claude:2026-05-01
     environment:
       CLAUDE_CODE_OAUTH_TOKEN: