fix(ci): test Trivy workflow

Author: Mafyuh

.github/workflows/trivy.yml

@@ -12,22 +12,32 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      - name: Fetch all history for git diff
+        run: |
+          if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+            git fetch --unshallow
+          else
+            git fetch --depth=2
+          fi
+
       - name: Extract changed images from PR diff
         id: images
         run: |
-          # Fetch the base branch with sufficient history
-          git fetch origin ${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }} --depth=100
+          echo "=== Analyzing PR diff for container images ==="
           
-          # Find merge base and create diff
-          MERGE_BASE=$(git merge-base HEAD origin/${{ github.base_ref }})
-          echo "Using merge base: $MERGE_BASE"
+          # Get all changed files in docker/ and kubernetes/
+          changed_files=$(git diff --name-only HEAD~1 HEAD | grep -E '^(docker|kubernetes)/' || true)
+          echo "Changed files: $changed_files"
           
-          echo "=== Analyzing PR diff for container images ==="
-          git diff $MERGE_BASE...HEAD --name-only | head -10
-
-          # Look for changes to k8s images
-          repo=$(git diff $MERGE_BASE...HEAD | grep -E '^\+.*repository:' | sed -E 's/.*repository:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1)
-          tag=$(git diff $MERGE_BASE...HEAD | grep -E '^\+.*tag:' | sed -E 's/.*tag:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1)
+          if [ -z "$changed_files" ]; then
+            echo "No docker or kubernetes files changed"
+            echo "should_scan=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
+          # Look for changes to k8s images in the actual diff
+          repo=$(git diff HEAD~1 HEAD | grep -E '^\+.*repository:' | sed -E 's/.*repository:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1)
+          tag=$(git diff HEAD~1 HEAD | grep -E '^\+.*tag:' | sed -E 's/.*tag:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1)
           
           echo "Found k8s repo: '$repo', tag: '$tag'"
 
@@ -36,7 +46,7 @@ jobs:
             echo "Using k8s format: $image"
           else
             # Fall back to plain image: lines (docker-compose)
-            image=$(git diff $MERGE_BASE...HEAD | grep -E '^\+.*image:' | sed -E 's/.*image:[[:space:]]*([^[:space:]#]+).*/\1/' | head -n1)
+            image=$(git diff HEAD~1 HEAD | grep -E '^\+.*image:' | sed -E 's/.*image:[[:space:]]*([^[:space:]#]+).*/\1/' | head -n1)
             echo "Raw image found: '$image'"
             
             # Clean up common prefixes and quotes
@@ -57,6 +67,7 @@ jobs:
           fi
 
       - name: Scan changed image with Trivy
+        if: steps.images.outputs.should_scan == 'true'
         uses: aquasecurity/trivy-action@0.33.1
         with:
           image-ref: ${{ steps.images.outputs.image }}