From 69ec593bead92bd0bb093bb59bd196d5be83564f Mon Sep 17 00:00:00 2001
From: Claude Code <claude@siax.io>
Date: Tue, 10 Nov 2026 16:23:36 +0100
Subject: [PATCH] =?UTF-8?q?fix(ci):=20uppdatera=20security-workflow=20till?=
 =?UTF-8?q?=20kanonisk=20mall=20(volymscan=20+=20l=C3=A5sfils-guard)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/security.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index c3d33f4d6..a91db0241 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -59,9 +59,20 @@ jobs:
       # Trivy filsystem, blockerar på HIGH och CRITICAL (SUP-*)
       - name: Trivy filesystem scan
         run: |
+          # node_modules/dist/.next/vendor skannas inte: de är byggartefakter,
+          # inte källkod. --ignorefile används bara när repot har en granskad
+          # .trivyignore (annars faller trivy på en saknad fil).
           docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
-            aquasec/trivy:latest fs --scanners vuln,secret,misconfig \
-            --severity HIGH,CRITICAL --exit-code 1 --no-progress /repo
+            aquasec/trivy:latest sh -c '
+              set -e
+              common="fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 --no-progress \
+                --skip-dirs /repo/node_modules --skip-dirs /repo/.next --skip-dirs /repo/dist \
+                --skip-dirs /repo/build --skip-dirs /repo/vendor --skip-dirs /repo/.git"
+              if [ -f /repo/.trivyignore ]; then
+                trivy $common --ignorefile /repo/.trivyignore /repo
+              else
+                trivy $common /repo
+              fi'
 
       # Kända sårbarheter i låsfilen. osv-scanner 2.x hittar inte alltid
       # osv-scanner.toml själv, så den skickas explicit när den finns.