ci: add Trivy security scan to PR pipeline

.github/steps/trivy/action.yml

@@ -0,0 +1,106 @@
+name: "Vulnerability Scan"
+description: "Trivy PR security scans. scan: code = repo dependencies (HIGH/CRITICAL) + Dockerfile base images (CRITICAL), image = image built in the pipeline (HIGH/CRITICAL). Each scan uploads its TSV report as an artifact"
+
+inputs:
+  scan:
+    description: "code | image"
+    required: true
+  maven-token:
+    description: "Token for internal GitHub Packages: Maven resolution (scan: code) and docker build secret (scan: image)"
+    required: false
+    default: ${{ github.token }}
+  image-name:
+    description: "Service name from the matrix; used in the artifact name"
+    required: false
+  path:
+    description: "Directory to scan (scan: code), e.g. a single service; defaults to the whole repo"
+    required: false
+    default: "."
+  skip-dirs:
+    description: "Comma-separated directories to exclude from the code scan (e.g. service dirs already scanned by the matrix)"
+    required: false
+    default: ""
+  dockerfile:
+    description: "Path to the service Dockerfile (scan: image)"
+    required: false
+  context:
+    description: "Docker build context (scan: image)"
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: Install Trivy
+      uses: aquasecurity/setup-trivy@v0.3.1
+      with:
+        version: v0.73.0
+        cache: true
+
+    - name: Scan dependencies and Dockerfile base images
+      if: inputs.scan == 'code'
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.maven-token }}
+        GITHUB_ACTOR: ${{ github.actor }}
+      run: |
+        set -euo pipefail
+        dir="${{ inputs.path }}"
+        if [ -f "$dir/pom.xml" ]; then  # warm ~/.m2 via Google's Central mirror so trivy sees parent-managed versions
+          echo '<settings><mirrors><mirror><id>google-central</id><url>https://maven-central.storage-download.googleapis.com/maven2/</url><mirrorOf>central</mirrorOf></mirror></mirrors></settings>' > /tmp/mirror.xml
+          mvn -B -q -fn -DskipTests -gs /tmp/mirror.xml -f "$dir/pom.xml" $([ -f .mvn/settings.xml ] && echo '-s .mvn/settings.xml') dependency:go-offline | tee /tmp/mvn.log || true
+          ! grep -q '\[ERROR\]' /tmp/mvn.log || echo "::warning::Some Maven dependencies could not be resolved; scan depth may be reduced"
+        fi
+        skip="${{ inputs.skip-dirs }}"
+        targs=(--no-progress --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --offline-scan --format json)
+        [ -n "$skip" ] && targs+=(--skip-dirs "$skip")
+        trivy fs "${targs[@]}" "$dir" |
+          jq -r '.Results[]? as $r | $r.Vulnerabilities[]? | [.Severity, .PkgName, .InstalledVersion, (.FixedVersion // "-"), .VulnerabilityID, $r.Target] | @tsv' | sort -u > "trivy-${GITHUB_REPOSITORY##*/}-code-report.tsv"
+
+        out="trivy-${GITHUB_REPOSITORY##*/}-docker-report.tsv"; : > "$out"
+        fargs=(-name 'Dockerfile*' -not -path '*/.git/*' -not -path '*/node_modules/*')
+        [ -n "$skip" ] && for d in ${skip//,/ }; do fargs+=(-not -path "*/${d}/*" -not -path "${d}/*"); done
+        find "$dir" "${fargs[@]}" -print0 |
+          xargs -0 -r awk 'toupper($1)=="FROM" {i=$2; if (i ~ /^--/) i=$3; print i; if (toupper($3)=="AS") print "~"$4; if (toupper($4)=="AS") print "~"$5}' | sort -u > /tmp/from.txt
+        for img in $(grep -v '^~' /tmp/from.txt); do
+          [ "$img" = scratch ] && continue
+          case "$img" in *'$'*) echo "::warning::Skipping base image with unresolved variable: ${img}"; continue ;; esac
+          grep -qxF "~$img" /tmp/from.txt && continue
+          trivy image --no-progress --scanners vuln --severity CRITICAL --ignore-unfixed --format json "$img" |
+            jq -r --arg img "$img" '.Results[]? as $r | $r.Vulnerabilities[]? | [.Severity, .PkgName, .InstalledVersion, (.FixedVersion // "-"), .VulnerabilityID, $img] | @tsv' >> "$out" ||
+            echo "::warning::Base image ${img} could not be scanned (pull/scan error); it was NOT checked"
+        done
+        sort -u "$out" -o "$out"
+        find . -maxdepth 1 -name 'trivy-*.tsv' -empty -delete
+
+    - name: Scan built image
+      if: inputs.scan == 'image'
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.maven-token }}
+        GITHUB_ACTOR: ${{ github.actor }}
+      run: |
+        set -euo pipefail
+        docker buildx build --platform linux/amd64 --secret id=GITHUB_TOKEN,env=GITHUB_TOKEN --build-arg GITHUB_ACTOR="$GITHUB_ACTOR" \
+          -f "${{ inputs.dockerfile }}" --output type=oci,dest=/tmp/image.tar "${{ inputs.context }}"
+        out="trivy-${GITHUB_REPOSITORY##*/}-image-report-${{ inputs.image-name }}.tsv"
+        trivy image --no-progress --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --input /tmp/image.tar --format json |
+          jq -r '.Results[]? as $r | $r.Vulnerabilities[]? | [.Severity, .PkgName, .InstalledVersion, (.FixedVersion // "-"), .VulnerabilityID, $r.Target] | @tsv' | sort -u > "$out"
+        find . -maxdepth 1 -name 'trivy-*.tsv' -empty -delete
+
+    - name: Upload report
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.scan == 'code' && (inputs.image-name && format('scan_code-{0}', inputs.image-name) || 'scan_code') || format('scan_image-{0}', inputs.image-name) }}
+        path: trivy-*.tsv
+        if-no-files-found: ignore
+
+    - name: Evaluate
+      shell: bash
+      env:
+        ARTIFACT: ${{ inputs.scan == 'code' && 'scan_code' || 'scan_image' }}
+      run: |
+        set -euo pipefail
+        files=$(ls trivy-*.tsv 2>/dev/null) || { echo "No vulnerabilities found."; exit 0; }
+        column -t -s "$(printf '\t')" $files
+        echo "::error::Trivy found $(cut -f1,2,5 $files | sort -u | wc -l | tr -d ' ') unique HIGH/CRITICAL vulnerabilities ($(cat $files | wc -l | tr -d ' ') occurrences across modules) — full report in the ${ARTIFACT} artifact"
+        exit 1

.github/workflows/test.yml

@@ -28,6 +28,26 @@ jobs:
     if: github.event.pull_request.state == 'open' && !github.event.pull_request.draft
 
 
+  scan:
+    name: "Scan"
+    runs-on: ubuntu-latest
+    needs: [changes]
+    permissions:
+      contents: read
+      packages: read
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Scan code
+        uses: ./.github/steps/trivy
+        with:
+          scan: code
+
   test-java:
     name: Test Java
     runs-on: ubuntu-latest
@@ -80,7 +100,7 @@ jobs:
     name: Test Node (${{ matrix.name }})
     runs-on: ubuntu-latest
     needs: [changes]
-    # npm's defaults allow 970s of silence per hung registry socket; these bound it to 115s 
+    # npm's defaults allow 970s of silence per hung registry socket; these bound it to 115s
     env:
       NPM_CONFIG_FETCH_TIMEOUT: 30000
       NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: 15000
@@ -222,7 +242,7 @@ jobs:
     needs: [changes, test-java, test-node, test-rust]
     runs-on: ubuntu-latest
     if: |
-      always() && 
+      always() &&
       (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || !contains(needs.*.result, 'skipped'))
     steps:
       - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}

.trivyignore

@@ -0,0 +1,3 @@
+# Vulnerabilities to skip in the Trivy scan: one CVE/GHSA id per line, e.g.:
+#
+# CVE-2026-12345