ci: run Trivy from its official image and drop the gha cache

aquasecurity/trivy-action clones the Trivy repository from the workflow's own
server, which on Gitea is not GitHub. The gha buildx cache has no Gitea
counterpart.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -148,14 +148,15 @@ jobs:
       # A mail server holds credentials for every mailbox it serves, so the
       # secret scanner matters as much as the vulnerability one here: a DKIM
       # key or a Cloudflare token committed by accident is a full compromise.
+      #
+      # Trivy runs from its official image rather than aquasecurity/trivy-action:
+      # that action clones the Trivy repository from the workflow's own server,
+      # which on Gitea is not GitHub.
       - name: Repositório
-        uses: aquasecurity/trivy-action@v0.36.0
-        with:
-          scan-type: fs
-          scanners: vuln,secret,misconfig
-          severity: HIGH,CRITICAL
-          exit-code: '1'
-          skip-dirs: services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next
+        run: |
+          docker run --rm --network host -v "$PWD:/src" -w /src aquasec/trivy:0.70.0 \
+            fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 \
+            --skip-dirs services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next .
 
       # MEDIUM is reported but does not fail the build.
       #
@@ -168,13 +169,10 @@ jobs:
       # Reporting rather than gating, because failing on every MEDIUM makes the
       # scanner something people learn to skip.
       - name: Repositório (MEDIUM, informativo)
-        uses: aquasecurity/trivy-action@v0.36.0
-        with:
-          scan-type: fs
-          scanners: vuln,secret
-          severity: MEDIUM
-          exit-code: '0'
-          skip-dirs: services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next
+        run: |
+          docker run --rm --network host -v "$PWD:/src" -w /src aquasec/trivy:0.70.0 \
+            fs --scanners vuln,secret --severity MEDIUM --exit-code 0 \
+            --skip-dirs services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next .
 
   image:
     name: Imagem (${{ matrix.service }})
@@ -198,8 +196,6 @@ jobs:
           push: false
           load: true
           tags: lambdamail-${{ matrix.service }}:ci
-          cache-from: type=gha,scope=${{ matrix.service }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.service }}
 
       # Scanned only for the images whose contents we author. migrations and
       # rspamd add .sql and .conf files to an upstream image and nothing else,
@@ -209,11 +205,9 @@ jobs:
       # that their base images have to be watched.
       - name: Trivy na imagem
         if: matrix.service != 'migrations' && matrix.service != 'rspamd'
-        uses: aquasecurity/trivy-action@v0.36.0
-        with:
-          image-ref: lambdamail-${{ matrix.service }}:ci
-          severity: HIGH,CRITICAL
-          exit-code: '1'
+        run: |
+          docker run --rm --network host -e DOCKER_HOST=tcp://127.0.0.1:2375 aquasec/trivy:0.70.0 \
+            image --severity HIGH,CRITICAL --exit-code 1 lambdamail-${{ matrix.service }}:ci
 
   compose-up:
     name: Stack completa