From 7db1b397200716155c75c3dbcc599743c10c350b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 11:00:29 +0200
Subject: [PATCH 01/32] feat: OPS-11657 devcontainer build support

---
 .github/workflows/image-publish-trivy.yaml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 07e441e..b46a458 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -100,6 +100,11 @@ on:
         required: false
         default: checkout
         type: string
+      build_type:
+        description: "What to build: 'container' or 'devcontainer'"
+        required: false
+        default: container
+        type: string
     secrets:
       DOCKER_USERNAME:
         required: false
@@ -193,6 +198,7 @@ jobs:
           password: ${{ secrets.QUAY_TOKEN }}
       
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
+        if: ${{ inputs.build_type == 'container' }}
         id: docker_build_push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a #v7.3.0
         with:
@@ -203,7 +209,16 @@ jobs:
           labels: ${{ steps.docker_meta_img.outputs.labels }}
           target: ${{ inputs.target }}
           build-args: ${{ inputs.build_args }}
-  
+
+      - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
+        if: ${{ inputs.build_type == 'devcontainer' }}
+        uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
+        with:
+          configFile: ${{ inputs.context }}/devcontainer.json
+          imageName: ${{ steps.docker_meta_img.outputs.name }}
+          imageTag: ${{ steps.docker_meta_img.outputs.tags }}
+          push: always
+
   pre_scan:
     runs-on: ubuntu-latest
     if: ${{ inputs.run_trivy_scan }}

From 36b6d2e3943e282aaa752c3b18aab2a30f053a26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:02:17 +0200
Subject: [PATCH 02/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index b46a458..ff86ac7 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -211,12 +211,13 @@ jobs:
           build-args: ${{ inputs.build_args }}
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
-        if: ${{ inputs.build_type == 'devcontainer' }}
+        if: ${{ inputs.build_type == 'devcontainer' }} and ${{ contains(inputs.container_registry, 'ghcr.io')
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json
-          imageName: ${{ steps.docker_meta_img.outputs.name }}
-          imageTag: ${{ steps.docker_meta_img.outputs.tags }}
+          imageName: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
+          cacheFrom: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
+          imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
           push: always
 
   pre_scan:

From 4cd8599dd55dbe9d46da91b6cf02b4321d18e425 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:02:43 +0200
Subject: [PATCH 03/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index ff86ac7..2d83fed 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -211,7 +211,7 @@ jobs:
           build-args: ${{ inputs.build_args }}
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
-        if: ${{ inputs.build_type == 'devcontainer' }} and ${{ contains(inputs.container_registry, 'ghcr.io')
+        if: ${{ inputs.build_type == 'devcontainer' }} and ${{ contains(inputs.container_registry, 'ghcr.io') }}
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json

From 8c201898e39d608c1ea4d7afc3c5d92197078b86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:09:36 +0200
Subject: [PATCH 04/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 2d83fed..c37b2b4 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -215,9 +215,9 @@ jobs:
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json
-          imageName: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
-          cacheFrom: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
-          imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
+          imageName: ${{ steps.docker_meta_img.outputs.tags
+          #cacheFrom: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
+          #imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
           push: always
 
   pre_scan:

From c4b4cc14fa76a23924806b0b6787bac28082a043 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:09:49 +0200
Subject: [PATCH 05/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index c37b2b4..c177dc2 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -215,7 +215,7 @@ jobs:
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json
-          imageName: ${{ steps.docker_meta_img.outputs.tags
+          imageName: ${{ steps.docker_meta_img.outputs.tags }}
           #cacheFrom: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
           #imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
           push: always

From d2edeb100fc906de34b5eb92f06d7ac29e0652de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:12:47 +0200
Subject: [PATCH 06/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index c177dc2..c7a16e4 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -211,13 +211,13 @@ jobs:
           build-args: ${{ inputs.build_args }}
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
-        if: ${{ inputs.build_type == 'devcontainer' }} and ${{ contains(inputs.container_registry, 'ghcr.io') }}
+        if: ${{ inputs.build_type == 'devcontainer' }} and ${{ contains(inputs.container_registry, 'ghcr.io') == true }}
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json
-          imageName: ${{ steps.docker_meta_img.outputs.tags }}
-          #cacheFrom: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}
-          #imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
+          imageName: ghcr.io/dbildungsplattform/${{ inputs.image_name }}
+          cacheFrom: ghcr.io/dbildungsplattform/${{ inputs.image_name }}
+          imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
           push: always
 
   pre_scan:

From e436a6b3cecc41949b592985958b7a6c7313110b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:51:10 +0200
Subject: [PATCH 07/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index c7a16e4..c7bb1b7 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -210,14 +210,20 @@ jobs:
           target: ${{ inputs.target }}
           build-args: ${{ inputs.build_args }}
 
+      - name: Extract image name
+        id: extract-image-name
+        run: |
+          echo "image-name="${{ split(DOCKER_METADATA_OUTPUT_TAGS, ':')[0] }}" " >> "$GITHUB_OUTPUT"
+
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
-        if: ${{ inputs.build_type == 'devcontainer' }} and ${{ contains(inputs.container_registry, 'ghcr.io') == true }}
+        if: ${{ inputs.build_type == 'devcontainer' }}
+        id: docker_build_push
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json
-          imageName: ghcr.io/dbildungsplattform/${{ inputs.image_name }}
-          cacheFrom: ghcr.io/dbildungsplattform/${{ inputs.image_name }}
-          imageTag: ${{ steps.docker_meta_img.outputs.tag-names }}
+          imageName: ${{ steps.sets-a-secret.outputs.extract-image-name.image-name }}
+          cacheFrom: ${{ steps.sets-a-secret.outputs.extract-image-name.image-name }}
+          imageTag: ${{ steps.docker_meta_img.outputs.tag-names }},latest
           push: always
 
   pre_scan:

From 28f383fad5d58cdf18d996e0270fbfb5a1dc4eb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:51:36 +0200
Subject: [PATCH 08/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index c7bb1b7..49611a9 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -213,7 +213,7 @@ jobs:
       - name: Extract image name
         id: extract-image-name
         run: |
-          echo "image-name="${{ split(DOCKER_METADATA_OUTPUT_TAGS, ':')[0] }}" " >> "$GITHUB_OUTPUT"
+          echo "image-name="${{ split(env.DOCKER_METADATA_OUTPUT_TAGS, ':')[0] }}" " >> "$GITHUB_OUTPUT"
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'devcontainer' }}

From ebe10fba30fb6c45bdc05f51d87720d64ac9cc77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:52:58 +0200
Subject: [PATCH 09/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 49611a9..bba30fa 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -213,8 +213,7 @@ jobs:
       - name: Extract image name
         id: extract-image-name
         run: |
-          echo "image-name="${{ split(env.DOCKER_METADATA_OUTPUT_TAGS, ':')[0] }}" " >> "$GITHUB_OUTPUT"
-
+          echo "image-name="${DOCKER_METADATA_OUTPUT_TAGS%%:*}" >> "$GITHUB_OUTPUT"
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'devcontainer' }}
         id: docker_build_push

From 974f260825aa9dc11b9efd9f49a2cc282c414c76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:56:49 +0200
Subject: [PATCH 10/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index bba30fa..888c184 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -120,7 +120,7 @@ jobs:
     name: Publish image
     runs-on: ubuntu-latest
     outputs:
-      digest: ${{ steps.docker_build_push.outputs.digest }}
+      digest: ${{ steps.docker_meta_img.outputs.tag-name }}
     permissions:
       packages: write
       contents: read
@@ -214,6 +214,7 @@ jobs:
         id: extract-image-name
         run: |
           echo "image-name="${DOCKER_METADATA_OUTPUT_TAGS%%:*}" >> "$GITHUB_OUTPUT"
+
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'devcontainer' }}
         id: docker_build_push

From e6602d3dcd055d520e16580030206b23f85c5ab2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 12:57:03 +0200
Subject: [PATCH 11/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 888c184..864d94a 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -217,7 +217,6 @@ jobs:
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'devcontainer' }}
-        id: docker_build_push
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json

From 666da780ea1f415c6089ded83ac808587b02f509 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:05:28 +0200
Subject: [PATCH 12/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 864d94a..af36a03 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -213,7 +213,7 @@ jobs:
       - name: Extract image name
         id: extract-image-name
         run: |
-          echo "image-name="${DOCKER_METADATA_OUTPUT_TAGS%%:*}" >> "$GITHUB_OUTPUT"
+          echo "image-name=${DOCKER_METADATA_OUTPUT_TAGS%%:*}" >> "$GITHUB_OUTPUT"
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'devcontainer' }}

From e09660ea52121473c6aa2d453467d91c4a66ec52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:09:55 +0200
Subject: [PATCH 13/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index af36a03..f9db789 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -173,7 +173,7 @@ jobs:
             type=raw,value=${{ inputs.image_tag }},enable=${{ contains(inputs.image_tag_generation, 'specified') }}
           flavor: |
             latest=${{ inputs.add_latest_tag }}
-      
+
       - name: Log into ghcr.io
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
         if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
@@ -196,7 +196,7 @@ jobs:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_TOKEN }}
-      
+
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'container' }}
         id: docker_build_push
@@ -212,6 +212,7 @@ jobs:
 
       - name: Extract image name
         id: extract-image-name
+        if: ${{ inputs.build_type == 'devcontainer' }}
         run: |
           echo "image-name=${DOCKER_METADATA_OUTPUT_TAGS%%:*}" >> "$GITHUB_OUTPUT"
 
@@ -220,8 +221,8 @@ jobs:
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca #v0.3.1900000450
         with:
           configFile: ${{ inputs.context }}/devcontainer.json
-          imageName: ${{ steps.sets-a-secret.outputs.extract-image-name.image-name }}
-          cacheFrom: ${{ steps.sets-a-secret.outputs.extract-image-name.image-name }}
+          imageName: ${{ steps.extract-image-name.outputs.image-name }}
+          cacheFrom: ${{ steps.extract-image-name.outputs.image-name }}
           imageTag: ${{ steps.docker_meta_img.outputs.tag-names }},latest
           push: always
 

From 429310906255b41f5b663645d4f0fe7d22f28028 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:14:48 +0200
Subject: [PATCH 14/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index f9db789..b6311b8 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -120,7 +120,7 @@ jobs:
     name: Publish image
     runs-on: ubuntu-latest
     outputs:
-      digest: ${{ steps.docker_meta_img.outputs.tag-name }}
+      digest: ${{ steps.docker_meta_img.outputs.tag-names }}
     permissions:
       packages: write
       contents: read

From 322dc6e3737c97f16e66995ccfd42b353c67be28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:22:52 +0200
Subject: [PATCH 15/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index b6311b8..1ac6e46 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -120,7 +120,7 @@ jobs:
     name: Publish image
     runs-on: ubuntu-latest
     outputs:
-      digest: ${{ steps.docker_meta_img.outputs.tag-names }}
+      digest: ${{ steps.docker_build_push.outputs.digest }}
     permissions:
       packages: write
       contents: read

From 637ac13d2bc766b96840413def30412fd94bc5a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:26:18 +0200
Subject: [PATCH 16/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 1ac6e46..2fe6760 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -121,6 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       digest: ${{ steps.docker_build_push.outputs.digest }}
+      tag: ${{ steps.docker_meta_img.outputs.tag-names }}
     permissions:
       packages: write
       contents: read
@@ -255,7 +256,7 @@ jobs:
       security-events: write
     uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@8
     with:
-      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}@${{ needs.build_and_upload_image.outputs.digest }}
+      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }}
       severity: ${{ inputs.trivy_severity }}
       fail_on_vulnerabilites: ${{ inputs.fail_on_vulnerabilites }}
       ignore-unfixed: ${{ inputs.ignore-unfixed }}
@@ -268,4 +269,4 @@ jobs:
     if: ${{ inputs.run_clamav_scan }}
     uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-image-clamav.yaml@8
     with:
-      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}@${{ needs.build_and_upload_image.outputs.digest }}
+      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }}

From a673007edb8be819565b0b28afb4fc1ff158c925 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:30:33 +0200
Subject: [PATCH 17/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 2fe6760..a4f5c2b 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -246,6 +246,14 @@ jobs:
           fi
           echo "registry_and_owner=$registry_and_owner" >> $GITHUB_OUTPUT
 
+      - name: Log into ghcr.io
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
   trivy_scan:
     name: Trivy scan for uploaded image
     # Wait for image upload

From 6282b036bdd50127a774e2f87faf54d6ea143842 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:49:15 +0200
Subject: [PATCH 18/32] fix

---
 .github/workflows/check-image-clamav.yaml  | 20 +++++++++++++++++++
 .github/workflows/check-trivy.yaml         | 23 ++++++++++++++++++++++
 .github/workflows/image-publish-trivy.yaml | 16 ++++-----------
 3 files changed, 47 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 0c1cda1..f43b586 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -17,6 +17,26 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install -y clamav
+    - name: Log into ghcr.io
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Log into dockerhub
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_TOKEN }}
+
+    - name: Log into quay.io
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_TOKEN }}
+
     - name: Extract image content
       env:
         IMAGE_REF: '${{ inputs.image_ref }}'
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 497f3f7..f0541bd 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -62,6 +62,29 @@ jobs:
         if: ${{ inputs.trivyignores != '' || inputs.scan_type == 'fs' }}
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  #v6.0.3
 
+      - name: Log into ghcr.io
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ inputs.scan_type == 'image' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log into dockerhub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ inputs.scan_type == 'image' }}
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Log into quay.io
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ inputs.scan_type == 'image' }}
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
       - name: Run Trivy vulnerability scanner on image or filesystem
         uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0
         with:
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index a4f5c2b..cd451ce 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -246,14 +246,6 @@ jobs:
           fi
           echo "registry_and_owner=$registry_and_owner" >> $GITHUB_OUTPUT
 
-      - name: Log into ghcr.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
   trivy_scan:
     name: Trivy scan for uploaded image
     # Wait for image upload
@@ -262,9 +254,9 @@ jobs:
     permissions:
       packages: read
       security-events: write
-    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@8
+    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11657
     with:
-      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }}
+      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity
       severity: ${{ inputs.trivy_severity }}
       fail_on_vulnerabilites: ${{ inputs.fail_on_vulnerabilites }}
       ignore-unfixed: ${{ inputs.ignore-unfixed }}
@@ -275,6 +267,6 @@ jobs:
     name: ClamAV scan of uploaded image
     needs: [build_and_upload_image, pre_scan]
     if: ${{ inputs.run_clamav_scan }}
-    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-image-clamav.yaml@8
+    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-image-clamav.yaml@OPS-11657
     with:
-      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }}
+      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity

From 0885ecddc99034aeeffca9b95caa93118df46cb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 13:53:14 +0200
Subject: [PATCH 19/32] fix

---
 .github/workflows/check-image-clamav.yaml  | 6 ------
 .github/workflows/check-trivy.yaml         | 7 -------
 .github/workflows/image-publish-trivy.yaml | 7 -------
 3 files changed, 20 deletions(-)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index f43b586..1624687 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -24,12 +24,6 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Log into dockerhub
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      with:
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_TOKEN }}
-
     - name: Log into quay.io
       uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
       with:
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index f0541bd..96d07f7 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -70,13 +70,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Log into dockerhub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ inputs.scan_type == 'image' }}
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-
       - name: Log into quay.io
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
         if: ${{ inputs.scan_type == 'image' }}
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index cd451ce..61b739c 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -183,13 +183,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       
-      - name: Log into dockerhub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ contains(inputs.container_registry, 'dockerhub') }}
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-      
       - name: Log into quay.io
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
         if: ${{ contains(inputs.container_registry, 'quay.io') }}

From bad02198ca6aa8a722187fc785d461e08b63b45f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:00:51 +0200
Subject: [PATCH 20/32] fix

---
 .../container-registry-login/action.yml       | 26 +++++++++++++++++++
 .github/workflows/check-image-clamav.yaml     | 22 +++++++---------
 .github/workflows/check-trivy.yaml            | 25 +++++++-----------
 .github/workflows/image-publish-trivy.yaml    | 16 +-----------
 4 files changed, 47 insertions(+), 42 deletions(-)
 create mode 100644 .github/actions/container-registry-login/action.yml

diff --git a/.github/actions/container-registry-login/action.yml b/.github/actions/container-registry-login/action.yml
new file mode 100644
index 0000000..2f1690a
--- /dev/null
+++ b/.github/actions/container-registry-login/action.yml
@@ -0,0 +1,26 @@
+name: 'Hello World'
+runs:
+  using: "composite"
+  steps:
+    - name: Log into ghcr.io
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Log into dockerhub
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'dockerhub') }}
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_TOKEN }}
+
+    - name: Log into quay.io
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'quay.io') }}
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_TOKEN }}
diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 1624687..766b6fe 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -7,6 +7,15 @@ on:
         description: "Image that should be scanned"
         required: true
         type: string
+    secrets:
+      DOCKER_USERNAME:
+        required: false
+      DOCKER_TOKEN:
+        required: false
+      QUAY_USERNAME:
+        required: false
+      QUAY_TOKEN:
+        required: false
 
 jobs:
   scan:
@@ -17,19 +26,8 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install -y clamav
-    - name: Log into ghcr.io
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Log into quay.io
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      with:
-        registry: quay.io
-        username: ${{ secrets.QUAY_USERNAME }}
-        password: ${{ secrets.QUAY_TOKEN }}
+    - uses: ./.github/actions/container-registry-login
 
     - name: Extract image content
       env:
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 96d07f7..7915fb8 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -42,6 +42,15 @@ on:
         required: false
         default: 'image'
         type: string
+    secrets:
+      DOCKER_USERNAME:
+        required: false
+      DOCKER_TOKEN:
+        required: false
+      QUAY_USERNAME:
+        required: false
+      QUAY_TOKEN:
+        required: false
 
 jobs:
   trivy_scan:
@@ -62,21 +71,7 @@ jobs:
         if: ${{ inputs.trivyignores != '' || inputs.scan_type == 'fs' }}
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  #v6.0.3
 
-      - name: Log into ghcr.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ inputs.scan_type == 'image' }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log into quay.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ inputs.scan_type == 'image' }}
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
+      - uses: ./.github/actions/container-registry-login
 
       - name: Run Trivy vulnerability scanner on image or filesystem
         uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 61b739c..f2a9d88 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -175,21 +175,7 @@ jobs:
           flavor: |
             latest=${{ inputs.add_latest_tag }}
 
-      - name: Log into ghcr.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      
-      - name: Log into quay.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ contains(inputs.container_registry, 'quay.io') }}
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
+      - uses: ./.github/actions/container-registry-login
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'container' }}

From 8bf47ed677fb37df5c4259de058a8a4cd9cf6376 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:03:41 +0200
Subject: [PATCH 21/32] fix

---
 .github/workflows/check-image-clamav.yaml  | 2 +-
 .github/workflows/check-trivy.yaml         | 2 +-
 .github/workflows/image-publish-trivy.yaml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 766b6fe..212024f 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -27,7 +27,7 @@ jobs:
         sudo apt-get update
         sudo apt-get install -y clamav
 
-    - uses: ./.github/actions/container-registry-login
+    - uses: dBildungsplattform/dbp-github-workflows/container-registry-login@OPS-11657
 
     - name: Extract image content
       env:
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 7915fb8..d0e981e 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -71,7 +71,7 @@ jobs:
         if: ${{ inputs.trivyignores != '' || inputs.scan_type == 'fs' }}
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  #v6.0.3
 
-      - uses: ./.github/actions/container-registry-login
+      - uses: dBildungsplattform/dbp-github-workflows/container-registry-login@OPS-11657
 
       - name: Run Trivy vulnerability scanner on image or filesystem
         uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index f2a9d88..2b65c94 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -175,7 +175,7 @@ jobs:
           flavor: |
             latest=${{ inputs.add_latest_tag }}
 
-      - uses: ./.github/actions/container-registry-login
+      - uses: dBildungsplattform/dbp-github-workflows/container-registry-login@OPS-11657
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'container' }}

From b2ce6e64973e2199c8dbfe546da6a9d54c0191be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:15:26 +0200
Subject: [PATCH 22/32] fix

---
 .github/workflows/check-image-clamav.yaml  | 2 +-
 .github/workflows/check-trivy.yaml         | 2 +-
 .github/workflows/image-publish-trivy.yaml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 212024f..5c6993c 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -27,7 +27,7 @@ jobs:
         sudo apt-get update
         sudo apt-get install -y clamav
 
-    - uses: dBildungsplattform/dbp-github-workflows/container-registry-login@OPS-11657
+    - uses: dBildungsplattform/dbp-github-workflows/.github/actions/container-registry-login@OPS-11657
 
     - name: Extract image content
       env:
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index d0e981e..4e1d2f4 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -71,7 +71,7 @@ jobs:
         if: ${{ inputs.trivyignores != '' || inputs.scan_type == 'fs' }}
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  #v6.0.3
 
-      - uses: dBildungsplattform/dbp-github-workflows/container-registry-login@OPS-11657
+      - uses: dBildungsplattform/dbp-github-workflows/.github/actions/container-registry-login@OPS-11657
 
       - name: Run Trivy vulnerability scanner on image or filesystem
         uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 2b65c94..ea544a1 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -175,7 +175,7 @@ jobs:
           flavor: |
             latest=${{ inputs.add_latest_tag }}
 
-      - uses: dBildungsplattform/dbp-github-workflows/container-registry-login@OPS-11657
+      - uses: dBildungsplattform/dbp-github-workflows/.github/actions/container-registry-login@OPS-11657
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'container' }}

From daaac65e8f45239cea930aa57f78b4389352b9a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:32:26 +0200
Subject: [PATCH 23/32] fix

---
 .../container-registry-login/action.yml       | 26 -------------------
 .github/workflows/check-image-clamav.yaml     |  8 +++++-
 .github/workflows/check-trivy.yaml            |  8 +++++-
 .github/workflows/image-publish-trivy.yaml    | 16 +++++++++++-
 4 files changed, 29 insertions(+), 29 deletions(-)
 delete mode 100644 .github/actions/container-registry-login/action.yml

diff --git a/.github/actions/container-registry-login/action.yml b/.github/actions/container-registry-login/action.yml
deleted file mode 100644
index 2f1690a..0000000
--- a/.github/actions/container-registry-login/action.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: 'Hello World'
-runs:
-  using: "composite"
-  steps:
-    - name: Log into ghcr.io
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Log into dockerhub
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      if: ${{ contains(inputs.container_registry, 'dockerhub') }}
-      with:
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_TOKEN }}
-
-    - name: Log into quay.io
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      if: ${{ contains(inputs.container_registry, 'quay.io') }}
-      with:
-        registry: quay.io
-        username: ${{ secrets.QUAY_USERNAME }}
-        password: ${{ secrets.QUAY_TOKEN }}
diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 5c6993c..404b19a 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -27,7 +27,13 @@ jobs:
         sudo apt-get update
         sudo apt-get install -y clamav
 
-    - uses: dBildungsplattform/dbp-github-workflows/.github/actions/container-registry-login@OPS-11657
+    - name: Log into ghcr.io
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Extract image content
       env:
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 4e1d2f4..990493a 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -71,7 +71,13 @@ jobs:
         if: ${{ inputs.trivyignores != '' || inputs.scan_type == 'fs' }}
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  #v6.0.3
 
-      - uses: dBildungsplattform/dbp-github-workflows/.github/actions/container-registry-login@OPS-11657
+      - name: Log into ghcr.io
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ inputs.scan_type == 'image' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Trivy vulnerability scanner on image or filesystem
         uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index ea544a1..4c961a3 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -175,7 +175,21 @@ jobs:
           flavor: |
             latest=${{ inputs.add_latest_tag }}
 
-      - uses: dBildungsplattform/dbp-github-workflows/.github/actions/container-registry-login@OPS-11657
+      - name: Log into ghcr.io
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log into quay.io
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ contains(inputs.container_registry, 'quay.io') }}
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
 
       - name: Build and push ${{ inputs.image_name }} to ${{ inputs.container_registry }}
         if: ${{ inputs.build_type == 'container' }}

From d62766af3b311e31a23a8d9aad282c7694df6fb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:33:16 +0200
Subject: [PATCH 24/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 4c961a3..8a86541 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -183,6 +183,13 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Log into dockerhub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+        if: ${{ contains(inputs.container_registry, 'dockerhub') }}
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
       - name: Log into quay.io
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
         if: ${{ contains(inputs.container_registry, 'quay.io') }}

From aa40545618371e78ad4403070d613569b49ad536 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:37:42 +0200
Subject: [PATCH 25/32] fix

---
 .github/workflows/check-image-clamav.yaml | 1 -
 .github/workflows/check-trivy.yaml        | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 404b19a..998dea0 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -29,7 +29,6 @@ jobs:
 
     - name: Log into ghcr.io
       uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-      if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 990493a..2c5585f 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -73,7 +73,7 @@ jobs:
 
       - name: Log into ghcr.io
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ inputs.scan_type == 'image' }}
+        if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From 5b129671cf2aff74533b8cf912965d85cb5e6f10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:40:29 +0200
Subject: [PATCH 26/32] fix

---
 .github/workflows/check-trivy.yaml | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 2c5585f..7636dbc 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -71,14 +71,6 @@ jobs:
         if: ${{ inputs.trivyignores != '' || inputs.scan_type == 'fs' }}
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  #v6.0.3
 
-      - name: Log into ghcr.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
-        if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Run Trivy vulnerability scanner on image or filesystem
         uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0
         with:
@@ -87,6 +79,7 @@ jobs:
           scan-ref: "." # if scan is for filesystem, will be ignored for image scan
           format: "sarif"
           output: "trivy-results.sarif"
+          github-pat: ${{ secrets.GITHUB_TOKEN }}
           severity: ${{ inputs.severity }}
           exit-code: ${{ inputs.fail_on_vulnerabilites && 1 || 0}}
           ignore-unfixed: ${{ inputs.ignore-unfixed }}

From 1bff7ee43086cbfc0910d5ea07d08613b7437a3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:47:39 +0200
Subject: [PATCH 27/32] fix

---
 .github/workflows/check-trivy.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 7636dbc..162ea7c 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -79,7 +79,6 @@ jobs:
           scan-ref: "." # if scan is for filesystem, will be ignored for image scan
           format: "sarif"
           output: "trivy-results.sarif"
-          github-pat: ${{ secrets.GITHUB_TOKEN }}
           severity: ${{ inputs.severity }}
           exit-code: ${{ inputs.fail_on_vulnerabilites && 1 || 0}}
           ignore-unfixed: ${{ inputs.ignore-unfixed }}
@@ -88,6 +87,8 @@ jobs:
         env:
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
+          TRIVY_USERNAME: ${{ github.actor }}
+          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Override location of findings
         if: ${{ always() && inputs.report_location != '' }}

From 90853b112ac3f16616cd1954ec7b8a71b0ccc195 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:51:46 +0200
Subject: [PATCH 28/32] fix

---
 .github/workflows/check-image-clamav.yaml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 998dea0..f8ffb21 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -7,15 +7,6 @@ on:
         description: "Image that should be scanned"
         required: true
         type: string
-    secrets:
-      DOCKER_USERNAME:
-        required: false
-      DOCKER_TOKEN:
-        required: false
-      QUAY_USERNAME:
-        required: false
-      QUAY_TOKEN:
-        required: false
 
 jobs:
   scan:

From aa12a82f2c3e8dc699dc031396a9534f771050f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:52:08 +0200
Subject: [PATCH 29/32] fix

---
 .github/workflows/check-trivy.yaml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml
index 162ea7c..bc0005f 100644
--- a/.github/workflows/check-trivy.yaml
+++ b/.github/workflows/check-trivy.yaml
@@ -42,15 +42,6 @@ on:
         required: false
         default: 'image'
         type: string
-    secrets:
-      DOCKER_USERNAME:
-        required: false
-      DOCKER_TOKEN:
-        required: false
-      QUAY_USERNAME:
-        required: false
-      QUAY_TOKEN:
-        required: false
 
 jobs:
   trivy_scan:

From 4cabbf5d7ec0db41499f76990e55bb72686ed311 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 14:52:58 +0200
Subject: [PATCH 30/32] fix

---
 .github/workflows/image-publish-trivy.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 8a86541..68a32f0 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -256,7 +256,7 @@ jobs:
       security-events: write
     uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11657
     with:
-      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity
+      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity compared to digests
       severity: ${{ inputs.trivy_severity }}
       fail_on_vulnerabilites: ${{ inputs.fail_on_vulnerabilites }}
       ignore-unfixed: ${{ inputs.ignore-unfixed }}
@@ -269,4 +269,4 @@ jobs:
     if: ${{ inputs.run_clamav_scan }}
     uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-image-clamav.yaml@OPS-11657
     with:
-      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity
+      image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity compared to digests

From 5c78f9ef3a58c3a6cccbc13e0712c79082ab1c75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 16:13:25 +0200
Subject: [PATCH 31/32] fix

---
 .github/workflows/check-image-clamav.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index f8ffb21..127299b 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -20,6 +20,7 @@ jobs:
 
     - name: Log into ghcr.io
       uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'ghcr.io') }}
       with:
         registry: ghcr.io
         username: ${{ github.actor }}

From 3bfdc24e1d11b791604221455995fe3d12111fc7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20J=C3=BCrgens?= <martin.juergens@capgemini.com>
Date: Mon, 3 Aug 2026 16:22:31 +0200
Subject: [PATCH 32/32] fix

---
 .github/workflows/check-image-clamav.yaml  | 29 ++++++++++++++++++++++
 .github/workflows/image-publish-trivy.yaml |  6 +++++
 2 files changed, 35 insertions(+)

diff --git a/.github/workflows/check-image-clamav.yaml b/.github/workflows/check-image-clamav.yaml
index 127299b..26c6186 100644
--- a/.github/workflows/check-image-clamav.yaml
+++ b/.github/workflows/check-image-clamav.yaml
@@ -7,6 +7,20 @@ on:
         description: "Image that should be scanned"
         required: true
         type: string
+      container_registry:
+        description: "Comma separated list of target container registries. Possible registries are ghcr.io (default), quay.io and dockerhub."
+        required: false
+        type: string
+        default: "ghcr.io"
+    secrets:
+      DOCKER_USERNAME:
+        required: false
+      DOCKER_TOKEN:
+        required: false
+      QUAY_USERNAME:
+        required: false
+      QUAY_TOKEN:
+        required: false
 
 jobs:
   scan:
@@ -26,6 +40,21 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Log into dockerhub
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'dockerhub') }}
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_TOKEN }}
+
+    - name: Log into quay.io
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 #v4.4.0
+      if: ${{ contains(inputs.container_registry, 'quay.io') }}
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_TOKEN }}
+
     - name: Extract image content
       env:
         IMAGE_REF: '${{ inputs.image_ref }}'
diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml
index 68a32f0..0ea559a 100644
--- a/.github/workflows/image-publish-trivy.yaml
+++ b/.github/workflows/image-publish-trivy.yaml
@@ -268,5 +268,11 @@ jobs:
     needs: [build_and_upload_image, pre_scan]
     if: ${{ inputs.run_clamav_scan }}
     uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-image-clamav.yaml@OPS-11657
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
+
     with:
       image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}:${{ needs.build_and_upload_image.outputs.tag }} # to have compatibility with both devcontainer and container builds, we use a tag reference and accept ambiguity compared to digests