From bb48e2ac1d644d725ad37b0811cfbdecf6b9f47c Mon Sep 17 00:00:00 2001
From: user2595 <user2595@noreply.git.eulernest.eu>
Date: Tue, 9 Jun 2026 15:14:08 +0000
Subject: [PATCH] =?UTF-8?q?ci(ai):=20fix=20security=20scan=20=E2=80=94=20a?=
 =?UTF-8?q?uth=20clone=20(org=20repo)=20+=20drop=20unsupported=20trivy=20f?=
 =?UTF-8?q?lag?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/security.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 0f6f4a0..e270c74 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -24,8 +24,10 @@ jobs:
       - name: Tooling
         run: apk add --no-cache git curl bash tar python3
 
-      - name: Repo auschecken (git.eulernest.eu -> LAN via Runner-add-host)
-        run: git clone --depth 1 "https://git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
+      - name: Repo auschecken (Auto-Token — Org-Repo braucht Auth; LAN via add-host)
+        env:
+          GITEA_TOKEN: ${{ github.token }}
+        run: git clone --depth 1 "https://x-access-token:${GITEA_TOKEN}@git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
 
       - name: Gitleaks (Secret-Scan, ARM64)
         id: gl
@@ -40,7 +42,7 @@ jobs:
         run: |
           curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
             | sh -s -- -b /usr/local/bin
-          cd src && trivy config --severity HIGH,CRITICAL --exit-code 1 --no-progress . 2>&1 | tee -a /tmp/scan.log
+          cd src && trivy config --severity HIGH,CRITICAL --exit-code 1 . 2>&1 | tee -a /tmp/scan.log
           echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
 
       - name: Gate — hart blockieren bei Funden