From d523ec14b8a4d066509b09c5b91bf08081f20056 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sun, 1 Mar 2026 23:38:14 +0100
Subject: [PATCH] ci: add Trivy image scanning for runtime images

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .gitlab-ci.yml | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 16d303793..222a44fbf 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -25,6 +25,7 @@ workflow:
 
 stages:
   - prepare
+  - scan
   - test
   - compile
   - train
@@ -251,6 +252,56 @@ build-foxhunt-training-runtime:
       --cache=true --cache-repo="${REGISTRY}/cache"
       --destination "${REGISTRY}/foxhunt-training-runtime:latest"
 
+# --------------------------------------------------------------------------
+# Stage 0.5: Scan runtime images for vulnerabilities (Trivy)
+# --------------------------------------------------------------------------
+scan-runtime-images:
+  stage: scan
+  image:
+    name: aquasec/trivy:latest
+    entrypoint: [""]
+  tags:
+    - kapsule
+    - docker
+  variables:
+    KUBERNETES_CPU_REQUEST: "200m"
+    KUBERNETES_CPU_LIMIT: "500m"
+    KUBERNETES_MEMORY_REQUEST: "256Mi"
+    KUBERNETES_MEMORY_LIMIT: "512Mi"
+  needs:
+    - job: build-foxhunt-runtime
+      optional: true
+    - job: build-foxhunt-training-runtime
+      optional: true
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"
+    - if: $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api"
+  cache:
+    key: trivy-db
+    paths:
+      - .trivy-cache/
+  before_script:
+    - export TRIVY_USERNAME=nologin
+    - export TRIVY_PASSWORD=${SCW_SECRET_KEY}
+  script:
+    - echo "Scanning runtime images for CRITICAL/HIGH vulnerabilities..."
+    - trivy image
+      --cache-dir .trivy-cache
+      --exit-code 1
+      --severity CRITICAL,HIGH
+      --ignore-unfixed
+      --no-progress
+      "${REGISTRY}/foxhunt-runtime:latest"
+    - trivy image
+      --cache-dir .trivy-cache
+      --exit-code 1
+      --severity CRITICAL,HIGH
+      --ignore-unfixed
+      --no-progress
+      "${REGISTRY}/foxhunt-training-runtime:latest"
+    - echo "Image scan passed — no fixable CRITICAL/HIGH vulnerabilities."
+  allow_failure: false
+
 
 # Base template for Rust jobs — pre-baked CI builder from Scaleway CR
 # Image pre-exists in SCR; rebuild via build-ci-builder when Dockerfile changes