From aaf6e14742dcd0b70e56546c559b367693694d56 Mon Sep 17 00:00:00 2001
From: Cristian Felipe Cruz Buitron <cristiancruz0529@gmail.com>
Date: Sun, 27 Sep 2026 23:38:14 +0000
Subject: [PATCH] ci: Trivy image solo con --scanners vuln (evita timeouts de
 15m)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

El escaneo de secretos que Trivy hace por defecto sobre toda la imagen
(node_modules incluido) hizo timeout (context deadline exceeded, 15m) en
el gate CRITICAL del backend el 2026-09-27; el propio log de Trivy
recomienda --scanners vuln. Aplicado a los 6 pasos trivy image (CRITICAL
bloqueante y HIGH informativo — un FATAL por timeout tumba el job aunque
--exit-code sea 0) de build.yaml, build-medusa.yaml y deploy-docs.yaml.

Sin pérdida real de cobertura (auditado por devsecops-auditor): Gitleaks
ya escanea todo el árbol de cada workload antes del build (needs:
gitleaks), ningún build recibe --build-arg/--secret con credenciales, los
ENV build-only del backend no llegan al stage final, y 11 corridas
recientes de image secret-scan tuvieron 0 hallazgos. Hueco residual
aceptado: secretos en capas de imágenes base oficiales.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018r19s4H8MBGegqToqw5guP
---
 .gitea/workflows/build-medusa.yaml | 2 ++
 .gitea/workflows/build.yaml        | 2 ++
 .gitea/workflows/deploy-docs.yaml  | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/.gitea/workflows/build-medusa.yaml b/.gitea/workflows/build-medusa.yaml
index 716e74f..26cb4da 100644
--- a/.gitea/workflows/build-medusa.yaml
+++ b/.gitea/workflows/build-medusa.yaml
@@ -235,6 +235,7 @@ jobs:
         run: |
           set -euo pipefail
           /tmp/trivy image \
+            --scanners vuln \
             --severity CRITICAL \
             --exit-code 1 \
             --ignore-unfixed \
@@ -248,6 +249,7 @@ jobs:
         run: |
           set -euo pipefail
           /tmp/trivy image \
+            --scanners vuln \
             --severity HIGH \
             --exit-code 0 \
             --ignore-unfixed \
diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index f3d51fa..79011c3 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -429,6 +429,7 @@ jobs:
         run: |
           set -euo pipefail
           /tmp/trivy image \
+            --scanners vuln \
             --severity CRITICAL \
             --exit-code 1 \
             --ignore-unfixed \
@@ -442,6 +443,7 @@ jobs:
         run: |
           set -euo pipefail
           /tmp/trivy image \
+            --scanners vuln \
             --severity HIGH \
             --exit-code 0 \
             --ignore-unfixed \
diff --git a/.gitea/workflows/deploy-docs.yaml b/.gitea/workflows/deploy-docs.yaml
index 2d5961a..87c25ff 100644
--- a/.gitea/workflows/deploy-docs.yaml
+++ b/.gitea/workflows/deploy-docs.yaml
@@ -231,6 +231,7 @@ jobs:
         run: |
           set -euo pipefail
           /tmp/trivy image \
+            --scanners vuln \
             --severity CRITICAL \
             --exit-code 1 \
             --ignore-unfixed \
@@ -243,6 +244,7 @@ jobs:
         run: |
           set -euo pipefail
           /tmp/trivy image \
+            --scanners vuln \
             --severity HIGH \
             --exit-code 0 \
             --ignore-unfixed \