ci: add Trivy security scan to PR pipeline

[yaroslavmokflmg]

Adds a Trivy-based PR security gate:

• scans repository dependencies (lockfiles / pom.xml) and Dockerfile base images
• fails the pipeline on HIGH/CRITICAL vulnerabilities with a fix available
• findings are deduplicated across modules; suppressions go to .trivyignore with a justification comment
• wired into All Checks so merging is blocked when the scan is red

Summary by CodeRabbit

• New Features

  • Added automated security scanning for project dependencies and container base images.
  • Scans identify unfixed high- and critical-severity vulnerabilities and report occurrence counts.
  • Pull request checks now include the security scan before all checks can pass.

• Documentation

  • Added guidance for excluding known vulnerabilities from scans.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ae02ec0a-2704-4fbe-afd4-acf3b731e7e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

Trivy security checks

Layer / File(s)	Summary
Trivy scan action .github/steps/trivy/action.yml, .trivyignore	The composite action installs Trivy, resolves Maven dependencies offline, scans filesystem dependencies and Dockerfile base images, deduplicates findings, reports counts, and fails for HIGH or CRITICAL vulnerabilities. The ignore file documents the vulnerability ID format.
Pull request workflow integration .github/workflows/test.yml	The workflow runs the scan for non-draft open pull requests and makes all-checks wait for trivy_scan and build_image.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest as Pull request workflow
  participant TrivyScan as trivy_scan
  participant TrivyAction as Local Trivy action
  participant Trivy as Trivy
  PullRequest->>TrivyScan: Run for eligible pull request
  TrivyScan->>TrivyAction: Execute local action
  TrivyAction->>Trivy: Scan Maven dependencies and Dockerfile base images
  Trivy-->>TrivyAction: Return HIGH/CRITICAL findings
  TrivyAction-->>TrivyScan: Report results and exit status
  PullRequest->>PullRequest: Wait in all-checks

Loading

Suggested reviewers: aliaska-varieva

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes adding a Trivy security scan to the pull request pipeline.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/trivy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/steps/trivy/action.yml (1)

14-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin aquasecurity/setup-trivy to a commit SHA.

aquasecurity/setup-trivy@v0.3.1 relies on a mutable tag. Pin this action to the commit SHA, for example 81e5143, to reduce supply-chain risk from tag replacement or compromise.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/steps/trivy/action.yml around lines 14 - 17, Update the
aquasecurity/setup-trivy action reference from the mutable v0.3.1 tag to the
specified commit SHA 81e5143, while preserving the existing version and cache
inputs.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/steps/trivy/action.yml:
- Around line 56-68: Update the failed-scan branch in the image-processing loop
around the trivy image invocation to emit a GitHub Actions ::warning:: or
::error:: annotation that includes the affected image and failure context, while
retaining the existing continue behavior. Keep intentional skips for aliases,
scratch, and variable-based tags unchanged and distinct from actual trivy
failures.

In @.github/workflows/test.yml:
- Around line 34-37: Update the Checkout step in the trivy_scan job to set
persist-credentials to false in its actions/checkout@v4 configuration, while
preserving the existing pull-request head SHA ref.

---

Nitpick comments:
In @.github/steps/trivy/action.yml:
- Around line 14-17: Update the aquasecurity/setup-trivy action reference from
the mutable v0.3.1 tag to the specified commit SHA 81e5143, while preserving the
existing version and cache inputs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a8719eb0-e791-4150-a73d-328180348b29

📥 Commits

Reviewing files that changed from the base of the PR and between 3af80d9 and 5f08660.

📒 Files selected for processing (3)

• .github/steps/trivy/action.yml
• .github/workflows/test.yml
• .trivyignore