Nguyen Minh Phuc d70a7b622c ci: cache the trivy vuln DB in a named volume, not a $PWD bind ...

`-v "$PWD/.trivycache:/root/.cache/trivy"` was the third instance of the bug
that made gitleaks scan nothing. $PWD is a path in the job container, but the
-v is resolved by the daemon in the dind sidecar, which has no such directory
and silently creates an empty one. Every run logged `[vulndb] Need to update
DB` and re-downloaded the DB, and the cache it wrote went to a throwaway
directory inside dind. This file warns about the same trap in two other places.

A named volume lives in the dind daemon's own storage, which is the one thing
both sides agree on.

Verified in dind rather than assumed: cold pass logs `Need to update DB` /
`Downloading vulnerability DB` / `Artifact successfully downloaded` and leaves
1.1G in the volume; warm pass logs none of them. The old comment's "~50MB" was
wrong by 20x, so the comment now records the real figure and what reclaims it.

The two sibling pipelines on this runner (cicd-smoke, otel-demo) were checked
for the same bug and do not have it — they use `docker build <context>`, where
the client streams the context to the daemon.

2026-07-20 04:13:30 +00:00

..

ci.yaml

ci: cache the trivy vuln DB in a named volume, not a $PWD bind

2026-07-20 04:13:30 +00:00