From b438732bf76f7939090b279403633f313f910e34 Mon Sep 17 00:00:00 2001
From: "mendral-app[bot]" <233154221+mendral-app[bot]@users.noreply.github.com>
Date: Fri, 2 Jan 2026 01:15:43 -0800
Subject: [PATCH] Cache Trivy database to prevent HTTP 504 download failures

---
 .github/workflows/make.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml
index ea4dc0880..9f69b456b 100644
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -31,6 +31,13 @@ jobs:
       - uses: "docker/setup-qemu-action@v3"
       - uses: "docker/setup-buildx-action@v3"
       - uses: "sigstore/cosign-installer@v3"
+      - name: Cache Trivy database
+        uses: "actions/cache@v4"
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
       - uses: "anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c" # v0.20.5
       - uses: "goreleaser/goreleaser-action@v6"
         with:
@@ -50,6 +57,7 @@ jobs:
           ignore-unfixed: true
           vuln-type: "os,library"
           severity: "CRITICAL,HIGH"
+          cache-dir: ~/.cache/trivy
       - name: Scan Docker image with Trivy
         if: github.ref != 'refs/heads/main'
         uses: "aquasecurity/trivy-action@0.28.0"
@@ -60,6 +68,7 @@ jobs:
           ignore-unfixed: true
           vuln-type: "os,library"
           severity: "CRITICAL,HIGH"
+          cache-dir: ~/.cache/trivy
       - name: Upload Trivy scan results to GitHub Security tab
         if: github.ref == 'refs/heads/main'
         uses: github/codeql-action/upload-sarif@v4