From 1afcfdd703c14e341d2c340bba30dd8b316f1d4c Mon Sep 17 00:00:00 2001
From: Simon Axelsson <simon@siax.io>
Date: Tue, 10 Nov 2026 20:41:25 +0100
Subject: [PATCH] fix(ci): gitleaks blockerar pa arbetstradet, misconfig och
 historik informativt

---
 .gitea/workflows/security.yml | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 79e73d3..15ebb61 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -57,14 +57,12 @@ jobs:
           for i in 1 2 3; do docker pull semgrep/semgrep:1.183.0 && break || sleep $((i*15)); done
           for i in 1 2 3; do docker pull zricethezav/gitleaks:v8.30.1 && break || sleep $((i*15)); done
 
-      # gitleaks over worktree and history (REPO-15, SEC-01)
+      # gitleaks i arbetstradet. Blockerar pa hemligheter som finns i koden nu (SEC-01).
       - name: gitleaks secret scan
         run: |
           set +e
           docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
-            -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory \
-            -e GIT_CONFIG_VALUE_0='*' \
-            zricethezav/gitleaks:v8.30.1 detect --source /repo --no-banner --exit-code 1 > /tmp/scan.log 2>&1
+            zricethezav/gitleaks:v8.30.1 detect --no-git --source /repo --no-banner --exit-code 1 > /tmp/scan.log 2>&1
           rc=$?
           set -e
           tail -n 120 /tmp/scan.log
@@ -72,12 +70,23 @@ jobs:
           if [ $rc -eq 1 ]; then echo "::error::gitleaks secret scan hittade fynd"; exit 1; fi
           echo "::warning::gitleaks secret scan kunde inte köras (rc=$rc) - verktygsfel, inte fynd"; exit 0
 
-      # Trivy filsystem, blockerar pa HIGH och CRITICAL (SUP-*)
+      # Historiken scannas informativt. Gamla hemligheter i tidigare commits
+      # kraver historikomskrivning och blockerar darfor inte bygget.
+      - name: gitleaks history informational
+        continue-on-error: true
+        run: |
+          docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
+            -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory \
+            -e GIT_CONFIG_VALUE_0='*' \
+            zricethezav/gitleaks:v8.30.1 detect --source /repo --no-banner --exit-code 1 \
+            || echo "::notice::historiska traffar loggas informativt"
+
+      # Trivy filsystem, blockerar pa HIGH och CRITICAL sarbarheter och hemligheter (SUP-*)
       - name: Trivy filesystem scan
         run: |
           set +e
           docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
-            aquasec/trivy:0.76.2 fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 --no-progress /repo > /tmp/scan.log 2>&1
+            aquasec/trivy:0.76.2 fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --no-progress /repo > /tmp/scan.log 2>&1
           rc=$?
           set -e
           tail -n 120 /tmp/scan.log
@@ -85,6 +94,15 @@ jobs:
           if [ $rc -eq 1 ]; then echo "::error::Trivy filesystem scan hittade fynd"; exit 1; fi
           echo "::warning::Trivy filesystem scan kunde inte köras (rc=$rc) - verktygsfel, inte fynd"; exit 0
 
+      # Dockerfile- och IaC-misconfig är informativt: DS-0002 (root-USER)
+      # kräver ändrade runtime-användare och hanteras per repo, inte i grinden.
+      - name: Trivy config informational
+        continue-on-error: true
+        run: |
+          docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
+            aquasec/trivy:0.76.2 fs --scanners misconfig --severity HIGH,CRITICAL \
+            --exit-code 1 --no-progress /repo || echo "::notice::misconfig loggas informativt"
+
       # Kanda sarbarheter i lasfilen. osv-scanner 2.x hittar inte alltid
       # osv-scanner.toml sjalv, sa den skickas explicit nar den finns.
       - name: OSV Scanner