From 316a3410bfdedc1fea94cc908a5cc08f0bd3f997 Mon Sep 17 00:00:00 2001
From: ru-sh <shakirov.ruslan@gmail.com>
Date: Thu, 1 Oct 2026 23:32:10 +0400
Subject: [PATCH] Log in to ghcr.io before the nightly Trivy scan

The scan pulls ghcr.io/motuslabs/code-server:latest anonymously, but the
package is private, so every nightly run since the image moved to ghcr.io
has failed with UNAUTHORIZED. Grant the job packages: read and log in with
the workflow token first.
---
 .github/workflows/trivy-docker.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/trivy-docker.yaml b/.github/workflows/trivy-docker.yaml
index 5b6c30c3dd93..fd36861ed19c 100644
--- a/.github/workflows/trivy-docker.yaml
+++ b/.github/workflows/trivy-docker.yaml
@@ -28,7 +28,7 @@ permissions:
   contents: read
   deployments: none
   issues: none
-  packages: none
+  packages: read
   pull-requests: none
   repository-projects: none
   security-events: write
@@ -48,6 +48,14 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
+      # The image is a private ghcr.io package, so Trivy cannot pull it
+      # anonymously.
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run Trivy vulnerability scanner in image mode
         uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # latest
         with: