refactor security.yml

.github/workflows/security.yml

@@ -1,4 +1,5 @@
-name: Security checks
+---
+name: Security
 
 # yamllint disable-line rule:truthy
 on:
@@ -6,25 +7,30 @@ on:
   schedule:
     - cron: "42 05 * * *"
 
+permissions:
+  contents: read
+
 jobs:
-  dockers:
+  container:
-    name: Trivy ${{ matrix.image }}
+    name: Container
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
         with:
-          image-ref: 'searxng/searxng:latest'
+          persist-credentials: "false"
-          ignore-unfixed: false
-          vuln-type: 'os,library'
-          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
 
-      - name: Upload Trivy scan results to GitHub Security tab
+      - name: Run Trivy scanner
-        uses: github/codeql-action/upload-sarif@v2
+        uses: aquasecurity/trivy-action@0.30.0
         with:
-          sarif_file: 'trivy-results.sarif'
+          image-ref: "docker.io/searxng/searxng:latest"
+          vuln-type: "os,library"
+          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+          ignore-unfixed: "false"
+          format: "sarif"
+          output: "./trivy-results.sarif"
+
+      - name: Upload SARIFs
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "./trivy-results.sarif"