ci: enforce complete security audit coverage

tools/checks/security-audit/Dockerfile

@@ -48,7 +48,10 @@ RUN python -m pip install --upgrade pip \
   && osv-scanner --version \
   && trivy --version \
   && jscpd --version \
-  && pip-audit --progress-spinner off
+  && pip-audit --progress-spinner off \
+  && npm --version \
+  && radon --version \
+  && xenon --version
 
 RUN mkdir -p /workspace \
   && chmod 0777 /workspace

tools/checks/security-audit/run.sh

@@ -70,6 +70,10 @@ done
 REBUILD="${REBUILD:-0}"
 UPDATE="${UPDATE:-0}"
 BUILD_ONLY="${BUILD_ONLY:-0}"
+REQUIRE_TOOLS="${SECURITY_AUDIT_REQUIRE_TOOLS:-0}"
+if [[ "${CI:-false}" == "true" || "${GITEA_ACTIONS:-false}" == "true" ]]; then
+  REQUIRE_TOOLS=1
+fi
 
 declare -a DOCKER_CLI=()
 DOCKER_LOCATION=""
@@ -196,7 +200,7 @@ fi
   -e SECURITY_AUDIT_MODE="$MODE" \
   -e SECURITY_AUDIT_REPORTS_DIR="$REPORTS_DIR" \
   -e SECURITY_AUDIT_FAIL_ON_FINDINGS="${SECURITY_AUDIT_FAIL_ON_FINDINGS:-0}" \
-  -e SECURITY_AUDIT_REQUIRE_TOOLS="${SECURITY_AUDIT_REQUIRE_TOOLS:-0}" \
+  -e SECURITY_AUDIT_REQUIRE_TOOLS="$REQUIRE_TOOLS" \
   -e SECURITY_AUDIT_TOOLBOX_FINGERPRINT="$IMAGE_FINGERPRINT" \
   "${EXTRA_ENV[@]}" \
   "${WORKSPACE_MOUNT[@]}" \