ci: add Trivy security scan to PR pipeline

[yaroslavmokflmg]

Adds a Trivy-based PR security gate:

• scans repository dependencies (lockfiles / pom.xml) and Dockerfile base images
• fails the pipeline on HIGH/CRITICAL vulnerabilities with a fix available
• findings are deduplicated across modules; suppressions go to .trivyignore with a justification comment
• wired into All Checks so merging is blocked when the scan is red

Summary by CodeRabbit

• New Features

  • Added automated security scanning for project dependencies and Docker base images.
  • Scans identify unfixed high- and critical-severity vulnerabilities and report occurrence counts.
  • Pull request checks now fail when vulnerabilities or other required checks are detected.

• Configuration

  • Added support for excluding documented vulnerability IDs from scans.
  • Maven authentication can be configured for dependency scanning.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e026a5a-edf3-4e8c-912a-eddc2b22bd02

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

The pull request adds a composite Trivy action, integrates it into pull request checks, and adds .trivyignore guidance.

Trivy CI scanning

Layer / File(s)	Summary
Trivy scan action .github/steps/trivy/action.yml, .trivyignore	The action installs Trivy, resolves Maven dependencies offline, scans filesystem dependencies and Dockerfile base images, deduplicates findings, and fails on unfixed HIGH or CRITICAL vulnerabilities. The ignore file documents supported vulnerability identifiers.
CI scan and check aggregation .github/workflows/test.yml	The workflow runs the scan for eligible pull requests and makes all-checks depend on both the client build and Trivy scan.

Estimated code review effort: 4 (Complex) | ~30–60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as GitHub Actions workflow
  participant Action as Trivy composite action
  participant Maven as Maven dependency resolver
  participant Trivy as Trivy scanner
  Workflow->>Action: Run local vulnerability scan
  Action->>Maven: Resolve dependencies offline when pom.xml exists
  Action->>Trivy: Scan filesystem and Dockerfile base images
  Trivy-->>Action: Return vulnerability findings
  Action-->>Workflow: Print findings and return failure for HIGH or CRITICAL vulnerabilities

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a Trivy security scan to the pull request CI pipeline.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/trivy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/steps/trivy/action.yml:
- Around line 47-68: Update the image-processing loop to emit a GitHub Actions
::warning:: annotation before continuing for unresolved image references
containing “$”. Replace the plain “skip ${img}” output in the trivy failure
branch with a corresponding ::warning:: annotation that identifies the image and
scan failure, while preserving the existing skip behavior.

In @.github/workflows/test.yml:
- Around line 99-102: Update the actions/checkout@v4 step under the “Checkout”
workflow step to set persist-credentials to false, while preserving the existing
pull request head SHA ref and read-only scanning behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0558fe2a-5c56-4df7-a9c5-5d7e78ef268e

📥 Commits

Reviewing files that changed from the base of the PR and between 9918480 and 16444f6.

📒 Files selected for processing (3)

• .github/steps/trivy/action.yml
• .github/workflows/test.yml
• .trivyignore