ci: add Trivy security scan to PR pipeline - #92

Merged

yaroslavmokflmg merged 20 commits into

mainfrom

Sep 8, 2026

Commits on Sep 8, 2026

ci: add Trivy security scan to PR pipeline
yaroslavmokflmg
committed
bd63998
ci: harden trivy gate — no persisted git credentials, visible warnings for skipped scans
yaroslavmokflmg
committed
255961e
ci: make trivy gate non-blocking (allow fail) until devs have capacity
yaroslavmokflmg
committed
1131656
ci: trivy code+docker scan in one job, in-build image scan, per-scan TSV artifacts
yaroslavmokflmg
committed
82375c8
ci: merge all trivy reports into one artifact per run, skip empty reports
yaroslavmokflmg
committed
2ebf681
ci: merge all trivy reports into one artifact per run, dedupe upload step
yaroslavmokflmg
committed
75f55d2
ci: compact trivy action — piped scans, unified evaluate, single merged report
yaroslavmokflmg
committed
5583c66
ci: report unique vulnerability count in trivy error message
yaroslavmokflmg
committed
d91e74e
ci: rename scan_code/report jobs, split scan_code and scan_image report artifacts
yaroslavmokflmg
committed
0d93015
ci: rename scan steps — Scan code / Scan image, action Trivy -> Scan
yaroslavmokflmg
committed
33f0c04
ci: rename scan steps — Scan code / Scan image, action name Vulnerability Scan
yaroslavmokflmg
committed
6e1dffb
ci: point error message to scan_code/scan_image artifact
yaroslavmokflmg
committed
4ba807f
ci: per-service code scan matrix with root coverage, merge artifacts to scan_code/scan_image
yaroslavmokflmg
committed
31ad4c3
ci: strip trailing whitespace in test.yml
yaroslavmokflmg
committed
a410198
Fix image scan input format, add per-module scan matrix and dependency origin column
yaroslavmokflmg
committed
f29156b
Bump Trivy to v0.74.0
yaroslavmokflmg
committed
776bb3d
Address review: compact scan action, changes-driven module matrix, red commit status for image scan
yaroslavmokflmg
committed
af88376
Scan built image for OS packages only, java deps stay in code scan
yaroslavmokflmg
committed
3549a10
Split scan action into small named steps, extract maven mirror and jq filter
yaroslavmokflmg
committed
7b210e4
Root scan skips root pom (covered by service scans); revert changes.yaml, single Scan Code job in libs
yaroslavmokflmg
committed
741f033