feat: graceful skip without API key + finalize workflows (container/memory caps, ARM64)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workflows/security.example.yml

@@ -1,53 +1,56 @@
-# Feature B (+C) — Security-Scan, HART blockierend, mit KI-Klartext-Erklärung.
-# In ein Ziel-Repo kopieren nach: .gitea/workflows/security.yml
+# Feature B (+C) — Security-Scan (HART blockierend) + KI-Klartext-Erklärung.
+# Kopie -> .gitea/workflows/security.yml
 #
-# Ablauf: scannen (ohne sofort abzubrechen) -> Gate (failt hart bei Funden) ->
-# bei Fehler erklärt die KI die Funde im PR. So failt der Check verlässlich UND
-# der Erklär-Schritt sieht beide Reports.
+# Schlankes alpine-Image + Memory-Cap (Pi-Runner, capacity 1).  ⚠ ARM64-Binaries!
+# Gitleaks (Secrets) + Trivy config (IaC/Misconfig) — bewusst OHNE schweren
+# Vuln-DB-Scan (RAM-/zeitschonend auf dem Pi). Funde lassen den Check hart
+# fehlschlagen; danach erklärt die KI sie im PR (überspringt sauber ohne Key).
 name: Security
 
 on:
+  workflow_dispatch: {}
   pull_request:
-  push:
-    branches: [main, master]
+
+env:
+  GITLEAKS_VERSION: "8.18.4"
 
 jobs:
   scan:
     runs-on: eulernest
-    container: ghcr.io/catthehacker/ubuntu:act-latest
+    container:
+      image: alpine:3.20
+      options: "--memory=768m --memory-swap=1024m"
     steps:
-      - name: Checkout (volle Historie für Gitleaks)
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Tooling
+        run: apk add --no-cache git curl bash tar python3
 
-      - name: Gitleaks (Secret-Scan)
-        id: gitleaks
-        continue-on-error: true
+      - name: Repo auschecken (git.eulernest.eu -> LAN via Runner-add-host)
+        run: git clone --depth 1 "https://git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
+
+      - name: Gitleaks (Secret-Scan, ARM64)
+        id: gl
         run: |
-          curl -sSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_linux_x64.tar.gz \
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_arm64.tar.gz" \
             | tar -xz -C /usr/local/bin gitleaks
-          gitleaks detect --source . --report-format json --report-path /tmp/gitleaks.json --no-banner \
-            | tee /tmp/gitleaks.txt; echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+          cd src && gitleaks detect --no-git --source . --redact -v 2>&1 | tee /tmp/scan.log
+          echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
 
-      - name: Trivy (fs + IaC, HIGH/CRITICAL)
-        id: trivy
-        continue-on-error: true
+      - name: Trivy (IaC/config, leicht)
+        id: tv
         run: |
           curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
             | sh -s -- -b /usr/local/bin
-          trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
-            --exit-code 1 --no-progress . | tee /tmp/trivy.txt; echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+          cd src && trivy config --severity HIGH,CRITICAL --exit-code 1 --no-progress . 2>&1 | tee -a /tmp/scan.log
+          echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
 
       - name: Gate — hart blockieren bei Funden
         run: |
-          cat /tmp/gitleaks.txt /tmp/trivy.txt > /tmp/scan.log 2>/dev/null || true
-          if [ "${{ steps.gitleaks.outputs.code }}" != "0" ] || [ "${{ steps.trivy.outputs.code }}" != "0" ]; then
-            echo "Security-Funde — Check schlägt fehl (hart blockierend)."; exit 1
+          if [ "${{ steps.gl.outputs.code }}" != "0" ] || [ "${{ steps.tv.outputs.code }}" != "0" ]; then
+            echo "Security-Funde -> Check schlägt fehl (hart blockierend)."; exit 1
           fi
           echo "Keine HIGH/CRITICAL-Funde."
 
-      - name: KI erklärt die Funde (nur bei Fehler)
+      - name: KI erklärt die Funde (nur bei Fehler, überspringt ohne Key)
         if: failure()
         env:
           AI_PROVIDER: anthropic