From 126189b55b38855367c240ea4c94c9d51f001e95 Mon Sep 17 00:00:00 2001
From: Soner Sayakci <github@shyim.de>
Date: Tue, 27 Oct 2026 05:13:28 +0100
Subject: [PATCH 1/2] ci: use Docker Scout for container code scanning

---
 .github/workflows/security.yml | 48 +++++++++++++---------------------
 1 file changed, 18 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 7713edf..7e4e9ae 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   scan:
-    name: 'Image Scan (PHP: ${{ matrix.php-version }}, Variant: ${{ matrix.variant.name }})'
+    name: 'Image Scan (PHP: ${{ matrix.php-version }}, Variant: ${{ matrix.variant }})'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -21,42 +21,30 @@ jobs:
           - '8.4'
           - '8.5'
         variant:
-          - name: fpm
-            dockerfile: fpm/Dockerfile
-          - name: fpm-otel
-            dockerfile: fpm-otel/Dockerfile
-          - name: caddy
-            dockerfile: caddy/Dockerfile
-          - name: caddy-otel
-            dockerfile: caddy/Dockerfile
-          - name: nginx
-            dockerfile: nginx/Dockerfile
-          - name: nginx-otel
-            dockerfile: nginx/Dockerfile
-          - name: frankenphp
-            dockerfile: frankenphp/Dockerfile
-          - name: frankenphp-otel
-            dockerfile: frankenphp-otel/Dockerfile
+          - fpm
+          - fpm-otel
+          - caddy
+          - caddy-otel
+          - nginx
+          - nginx-otel
+          - frankenphp
+          - frankenphp-otel
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Pull image
-        run: docker pull shopware/docker-base:${{ matrix.php-version }}-${{ matrix.variant.name }}
-
-      - name: Login into Github Docker Registery
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-
       - name: Scan for vulnerabilities
-        id: scan
-        uses: crazy-max/ghaction-container-scan@v4
+        uses: docker/scout-action@v1
         with:
-          image: shopware/docker-base:${{ matrix.php-version }}-${{ matrix.variant.name }}
-          dockerfile: ./${{ matrix.variant.dockerfile }}
+          command: cves
+          image: registry://shopware/docker-base:${{ matrix.php-version }}-${{ matrix.variant }}
+          dockerhub-user: ${{ secrets.DOCKER_HUB_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+          sarif-file: scout.sarif.json
+          write-comment: false
 
       - name: Upload SARIF file
-        if: ${{ steps.scan.outputs.sarif != '' }}
         uses: github/codeql-action/upload-sarif@v4.39.1
         with:
-          sarif_file: ${{ steps.scan.outputs.sarif }}
-          category: ${{ matrix.php-version }}-${{ matrix.variant.name }}
+          sarif_file: scout.sarif.json
+          category: ${{ matrix.php-version }}-${{ matrix.variant }}

From f8098061a21b9fb578664ebef63f2735d7f04ed4 Mon Sep 17 00:00:00 2001
From: Soner Sayakci <github@shyim.de>
Date: Tue, 27 Oct 2026 05:14:50 +0100
Subject: [PATCH 2/2] ci: validate security workflow changes on pull requests

---
 .github/workflows/security.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 7e4e9ae..3d910aa 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -1,6 +1,14 @@
 name: Security Check
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/security.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/security.yml'
   schedule:
     - cron: '0 1 * * *'