ci: add Trivy security scan to PR pipeline

[yaroslavmokflmg]

Adds a Trivy-based PR security gate:

• scans repository dependencies (lockfiles / pom.xml) and Dockerfile base images
• fails the pipeline on HIGH/CRITICAL vulnerabilities with a fix available
• findings are deduplicated across modules; suppressions go to .trivyignore with a justification comment
• wired into All Checks so merging is blocked when the scan is red

Summary by CodeRabbit

• New Features
  • Added automated security scanning for repository files, dependencies, and container base images.
  • Pull requests are now checked for unfixed high- and critical-severity vulnerabilities.
• Bug Fixes
  • Checks fail when qualifying vulnerabilities are detected, helping prevent insecure changes from being merged.
• Documentation
  • Added guidance for excluding acknowledged vulnerabilities from scans.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c425d2e9-8072-4ecd-a813-79f7645b9635

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The pull request adds a composite Trivy action. The action resolves Maven dependencies, scans repository files and Dockerfile base images, aggregates findings, and fails on unfixed HIGH or CRITICAL vulnerabilities. A pull-request workflow job runs the scan and gates all-checks.

Changes

Trivy security scanning

Layer / File(s)	Summary
Scan action setup .github/steps/trivy/action.yml	The composite action accepts optional Maven authentication, installs a pinned Trivy version, and resolves Maven dependencies.
Scan and aggregate findings .github/steps/trivy/action.yml	The action scans filesystem dependencies and Dockerfile base images, merges reports, deduplicates findings, prints counts, and fails when vulnerabilities exist.
Pull request check integration .github/workflows/test.yml, .trivyignore	The workflow runs trivy_scan for eligible pull requests with read-only permissions. all-checks waits for the scan. .trivyignore documents the exclusion format.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant trivy_scan
  participant TrivyAction
  participant Maven
  participant Trivy
  PullRequest->>trivy_scan: trigger eligible pull request job
  trivy_scan->>TrivyAction: run shared scan action
  TrivyAction->>Maven: resolve project dependencies
  TrivyAction->>Trivy: scan files and Dockerfile base images
  Trivy-->>TrivyAction: return vulnerability reports
  TrivyAction-->>trivy_scan: return scan status
  trivy_scan-->>PullRequest: publish job result

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of a Trivy security scan to the pull request pipeline.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/trivy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/steps/trivy/action.yml:
- Around line 62-67: Update the trivy image-scan failure branch in the loop
around the `trivy image` command to exit nonzero when scanning a concrete image
fails, instead of always echoing and continuing. Preserve the existing skip
behavior for `scratch` and unresolved image variables by ensuring those cases
are filtered before this failure path.
- Around line 13-17: Update the Install Trivy step’s uses reference from the
mutable aquasecurity/setup-trivy@v0.3.1 tag to a reviewed, immutable
40-character commit SHA, keeping the existing version and cache inputs
unchanged.
- Around line 37-39: Update the Maven arguments in the dependency-resolution
step to remove the -fn flag, and make the mvn invocation propagate
dependency:go-offline failures instead of converting them into a warning.
Preserve the existing arguments and optional .mvn/settings.xml handling.

In @.github/workflows/test.yml:
- Around line 45-56: Update the trivy_scan workflow so fork pull requests never
run tokenized Maven dependency resolution: disable credential persistence in the
Checkout step and remove or conditionally skip the Trivy composite action’s
Maven resolution for fork-originated pull requests, while preserving it for
same-repository pull requests as appropriate.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 241c476c-3c1b-40af-99ff-2237a53055a1

📥 Commits

Reviewing files that changed from the base of the PR and between cad646d and bb5d9b7.

📒 Files selected for processing (3)

• .github/steps/trivy/action.yml
• .github/workflows/test.yml
• .trivyignore