ci: add Trivy security scan to PR pipeline

[yaroslavmokflmg]

Adds a Trivy-based PR security gate:

• scans repository dependencies (lockfiles / pom.xml) and Dockerfile base images
• fails the pipeline on HIGH/CRITICAL vulnerabilities with a fix available
• findings are deduplicated across modules; suppressions go to .trivyignore with a justification comment
• wired into All Checks so merging is blocked when the scan is red

Summary by CodeRabbit

• New Features

  • Added automated security scanning for pull requests.
  • Scans dependencies and container base images for high- and critical-severity vulnerabilities.
  • Displays grouped, deduplicated vulnerability findings and blocks checks when issues are detected.

• Documentation

  • Added guidance for excluding specific vulnerability IDs from scans.

[coderabbitai]

Warning

Review limit reached

@yaroslavmokflmg, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 36a84e9b-7d21-4626-b43d-9e4490b77bec

📥 Commits

Reviewing files that changed from the base of the PR and between 38eeab5 and e47e7b4.

📒 Files selected for processing (2)

• .github/steps/trivy/action.yml
• .github/workflows/test.yml

Walkthrough

Adds a composite Trivy action that installs and caches Trivy, resolves Maven dependencies when needed, scans repository dependencies and Dockerfile base images, groups findings, and fails on HIGH or CRITICAL vulnerabilities. Adds a pull-request workflow job with read-only permissions and includes it in all-checks. Adds .trivyignore documentation with an example vulnerability identifier.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of a Trivy security scan to the pull request pipeline.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/trivy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/steps/trivy/action.yml:
- Around line 37-39: Remove the -fn fail-never flag from the margs array used by
the Maven dependency:go-offline invocation, while preserving the remaining Maven
arguments and existing warning handling.
- Around line 56-67: Update the image-processing loop around the img variable to
track unresolved “$VAR” references and failed trivy image scans as skipped
images, while continuing to process the remaining entries. After the imgs.txt
loop completes, exit nonzero when any image was skipped; retain successful
scanning and alias/scratch filtering behavior.
- Around line 21-23: Remove the maven-token export as GITHUB_TOKEN in
.github/steps/trivy/action.yml lines 21-23, and prevent credentialed Maven
execution from loading the PR-controlled .mvn/settings.xml at lines 37-39 by
using a trusted settings file when credentials are required. In
.github/workflows/test.yml lines 40-48, remove packages: read from the untrusted
PR scan or otherwise ensure no credentials reach PR-controlled Maven execution.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: babf883c-dadc-41a7-8cd8-1ef148f05a8c

📥 Commits

Reviewing files that changed from the base of the PR and between beb5b4c and 38eeab5.

📒 Files selected for processing (3)

• .github/steps/trivy/action.yml
• .github/workflows/test.yml
• .trivyignore