From ea3a4df0a03d50fde25067e318beb8af2ef867c9 Mon Sep 17 00:00:00 2001
From: Francis Ferrell <francis.ferrell@kasm.com>
Date: Fri, 9 Jan 2026 09:54:16 -0500
Subject: [PATCH] QA-272 cache trivy in S3

This changes how the pipeline installs trivy. A scheduled job in the
qa-infrastructure project will download the latest release and store it
in S3. Jobs that use trivy retrieve it from there. This avoids rate
limiting and gives us more control over the version of trivy we use.
---
 ci-scripts/download-trivy     | 14 +++++++++-----
 ci-scripts/gitlab-ci.template |  4 ++--
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/ci-scripts/download-trivy b/ci-scripts/download-trivy
index d31fb93..c792c5e 100644
--- a/ci-scripts/download-trivy
+++ b/ci-scripts/download-trivy
@@ -1,14 +1,18 @@
 #!/bin/bash
-
 set -euo pipefail
 
-TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
-echo "$TRIVY_VERSION"
+arch=$(arch | sed -e 's/aarch64/arm64/g' -e 's/x86_64/x86/g')
+download_dir=$( mktemp -td )
+curl -fsSLO --output-dir "$download_dir" "https://${S3_BUCKET}.s3.amazonaws.com/trivy/trivy-${arch}.tar.gz"
+
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 trivy_dir="${SCRIPT_DIR}/trivy"
 rm -rf $trivy_dir
 mkdir $trivy_dir
 cd $trivy_dir
-wget --no-verbose "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -O - | tar -zxvf -
+tar -zxvf "${download_dir}/trivy-${arch}.tar.gz"
+echo "Using trivy $( ./trivy --version )"
 
-cp "${SCRIPT_DIR}/junit.tpl" "${SCRIPT_DIR}/trivy/contrib/"
\ No newline at end of file
+if [[ -e "${SCRIPT_DIR}/junit.tpl" ]]; then
+    cp -v "${SCRIPT_DIR}/junit.tpl" "${SCRIPT_DIR}/trivy/contrib/"
+fi
diff --git a/ci-scripts/gitlab-ci.template b/ci-scripts/gitlab-ci.template
index 7d62601..0d87f51 100644
--- a/ci-scripts/gitlab-ci.template
+++ b/ci-scripts/gitlab-ci.template
@@ -185,7 +185,7 @@ scan_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
       {% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
       {% endfor %}{% endif %}
   script:
-    - apk add bash
+    - apk add bash curl
     - (cd ci-scripts && bash download-trivy)
     - bash ci-scripts/scan image ${ORG_NAME}/image-cache-private:$(arch)-core-{{ IMAGE.name1 }}-{{ IMAGE.name2 }}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID}
   needs:
@@ -224,7 +224,7 @@ scan_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
       {% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
       {% endfor %}{% endif %}
   script:
-    - apk add bash
+    - apk add bash curl
     - (cd ci-scripts && bash download-trivy)
     - bash ci-scripts/scan image ${ORG_NAME}/image-cache-private:x86_64-core-{{ IMAGE.name1 }}-{{ IMAGE.name2 }}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID}
   needs: