From 70c7106fe8e7baa4480ca7a3d585fe0fe735b42c Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Mon, 24 Aug 2026 13:51:29 +0200
Subject: [PATCH] Give the Trivy scan render values for freesailarr

ci/run-trivy-config.sh renders every changed chart before scanning it and exits
non-zero when the render fails - which it does for freesailarr, because the
chart is excluded from the install-test and therefore has no
ci/freesailarr/test-values.yaml to fall back on. The scan job would go red
without ever scanning anything.

The file supplies only the values the chart declares required (secret ref,
cluster issuer, the three media claims and one ingress host per app, since the
chart has no global ingress.domain) and nothing that would alter the security
posture the scan is meant to look at.
---
 ci/trivy/values/freesailarr.yaml | 39 ++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 ci/trivy/values/freesailarr.yaml

diff --git a/ci/trivy/values/freesailarr.yaml b/ci/trivy/values/freesailarr.yaml
new file mode 100644
index 0000000..aaf50f5
--- /dev/null
+++ b/ci/trivy/values/freesailarr.yaml
@@ -0,0 +1,39 @@
+# Render values for the misconfiguration scan only (ci/run-trivy-config.sh).
+#
+# freesailarr has no ci/freesailarr/test-values.yaml because it is excluded from
+# the install-test (gluetun never becomes healthy without a real Wireguard key),
+# but it is still scanned - the chart runs nine containers with several
+# documented hardening deviations, which is exactly what the scan should see.
+#
+# Only the values the chart declares `required` - nothing that changes the
+# security posture (no securityContext, image, capability or resource overrides).
+# The ingress hosts are per app since the chart has no global ingress.domain.
+secrets:
+  gluetunSecretRef: op://Vault/scan/placeholder
+ingress:
+  clusterIssuer: letsencrypt
+media:
+  downloads:
+    existingClaim: scan-downloads
+  movies:
+    existingClaim: scan-movies
+  tv:
+    existingClaim: scan-tv
+qbittorrent:
+  ingress:
+    host: qbittorrent.scan.example.com
+prowlarr:
+  ingress:
+    host: prowlarr.scan.example.com
+radarr:
+  ingress:
+    host: radarr.scan.example.com
+sonarr:
+  ingress:
+    host: sonarr.scan.example.com
+seerr:
+  ingress:
+    host: seerr.scan.example.com
+bazarr:
+  ingress:
+    host: bazarr.scan.example.com