fix(ci): use reachable vulnerability database mirror

2026-07-17 15:38:59 +08:00
parent c67726ca6b
commit a6e95be0c5
5 changed files with 15 additions and 1 deletions
@@ -97,6 +97,12 @@ for quality_workflow in "$workflow" "$release_workflow"; do
      exit 1
    }
  done
+  grep -Fq 'TRIVY_DB_REPOSITORY: ghcr.m.daocloud.io/aquasecurity/trivy-db:2' \
+    "$quality_workflow" || {
+      printf '%s does not pin the reachable Trivy vulnerability DB mirror\n' \
+        "$quality_workflow" >&2
+      exit 1
+    }
 done

 if [[ $(sed -n '/^      - name: Verify Go formatting$/,$p' "$workflow") != \