[LarsLaskowski]

Pull Request

📖 Description

The Dockerfile now bundles Trivy v0.76.1 pinned by tag and digest, and the Trivy servers in the two compose files run the same version, so the -- protection from #367 runs on the binary it was measured on. v0.76.1 sends an update check with a host identifier to check.trivy.dev on every scan, so the image sets TRIVY_SKIP_VERSION_CHECK=true and TRIVY_DISABLE_TELEMETRY=true; the provider's arguments are unchanged. The #367 cases were re-run against the pinned image's binary with TRIVY_SERVER pointing at a closed port: without -- the target is read as an option, with -- each of the three option-like targets is treated as an image name and no file is read, and a normal target takes the normal scan path. The area documents and decision records 0005, 0015 and the new 0016 are updated. This is a chore that touches Docker/build configuration.

🎫 Issues

Closes #372

Decision records: 0005, 0015 (edited in place, unreleased), 0016 (new).

💬 Reviewer Notes

The change has no production or test code. The pin and the measurements could not use docker pull (no Docker daemon): the image index was fetched by digest from mirror.gcr.io because registry-1.docker.io answered 429, and the binary was extracted from its layers. Please check that the image still pulls in CI or on a host with Docker.

📑 Test Plan

No unit tests: nothing in the C# code changes. Verified by measurement: digest and layers, static trivy --version 0.76.1, the four #367 cases plus the normal path and an unknown tag under strace, and a control run showing the check.trivy.dev lookup that the two variables remove. hadolint, scope check and decision check pass.

✅ Checklist

• I have added or updated Unit Tests for the change.
• I have tested my changes.
• I have run Format and Build from .squad/stack.md, and the Analyzer gate reports no diagnostic in a changed file.
• The Coverage gate in .squad/stack.md passes (line coverage on new or changed production code and overall).
• I have updated the project documentation (README.md, ARCHITECTURE.md) to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.
• New dependencies, if any, were added the way Dependencies in .squad/stack.md prescribes.
• The C# rules in csharp.instructions.md are followed.

⏭ Next Steps

None.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud