refactor(ci): drop aquasecurity/trivy-action, use direct trivy binary

.github/.zizmor.yml

@@ -10,9 +10,3 @@ rules:
       # access to commit signatures). Mitigated: checkout uses ref: main
       # (not PR head), no untrusted input in run: steps.
       - cla.yml
-
-  template-injection:
-    ignore:
-      # steps.scan-ref.outputs.ref is set by echo in the same job (not
-      # user-controllable). zizmor flags it at Low confidence.
-      - docker.yml

.github/actions/build-apko-base/action.yml

@@ -100,7 +100,8 @@ runs:
         curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
         curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
         (cd /tmp && grep "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" trivy_checksums.txt | sha256sum -c -)
-        tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy
+        tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /tmp trivy
+        sudo install -m 0755 /tmp/trivy /usr/local/bin/trivy
 
     - name: Trivy scan
       shell: bash
@@ -120,19 +121,14 @@ runs:
 
     - name: Trivy SARIF scan
       if: always()
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-      with: # zizmor: ignore[template-injection]
-        image-ref: ghcr.io/aureliolo/synthorg-${{ inputs.image-name }}-base:${{ steps.image-ref.outputs.tag }}
-        format: sarif
-        output: trivy-${{ inputs.image-name }}-base.sarif
-        exit-code: "0"
-        severity: CRITICAL,HIGH
-        # Pin trivy version as a literal so zizmor's `unpinned-tools`
-        # audit recognises the pin. Keep in sync with TRIVY_VERSION env
-        # vars used by the curl-install steps in this composite.
-        # renovate: datasource=github-releases depName=aquasecurity/trivy
-        version: v0.70.0
-        trivyignores: .github/.trivyignore.yaml
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        IMAGE_TAG: ${{ steps.image-ref.outputs.tag }}
+      run: |
+        IMAGE_REF="ghcr.io/aureliolo/synthorg-${IMAGE_NAME}-base:${IMAGE_TAG}"
+        trivy image "${IMAGE_REF}" --format sarif --output "trivy-${IMAGE_NAME}-base.sarif" \
+          --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
     - name: Upload SARIF to GitHub Security
       if: always()

.github/actions/build-scan-image/action.yml

@@ -89,6 +89,9 @@ inputs:
       enable.
     required: false
     default: "false"
+  trivy-version:
+    description: "Trivy version, WITHOUT a leading `v` (e.g. `0.70.0`). The release download URL adds the `v` prefix; the tarball filename does not."
+    required: true
 
 outputs:
   ref_amd64:
@@ -308,20 +311,28 @@ runs:
         DISPLAY_NAME: ${{ inputs.display-name }}
       run: scripts/report-image-size.sh "$SCAN_REF" "$DISPLAY_NAME (arm64)"
 
+    - name: Install Trivy
+      shell: bash
+      env:
+        TRIVY_VERSION: ${{ inputs.trivy-version }}
+      run: |
+        curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+        curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
+        (cd /tmp && grep "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" trivy_checksums.txt | sha256sum -c -)
+        tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /tmp trivy
+        sudo install -m 0755 /tmp/trivy /usr/local/bin/trivy
+
     # Trivy JSON + SARIF + CIS benchmark per arch. JSON feeds
     # evaluate-scan.sh (fails on CRITICAL, warns on HIGH). SARIF goes to
     # GitHub Security for both arches with distinct categories.
     - name: Trivy scan (amd64)
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-      with:
-        image-ref: ${{ steps.scan-ref.outputs.ref_amd64 }}
-        format: json
-        output: trivy-${{ inputs.image-name }}-amd64.json
-        exit-code: "0"
-        severity: CRITICAL,HIGH
-        trivyignores: .github/.trivyignore.yaml
-        # renovate: datasource=github-releases depName=aquasecurity/trivy
-        version: v0.70.0
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        SCAN_REF: ${{ steps.scan-ref.outputs.ref_amd64 }}
+      run: |
+        trivy image "${SCAN_REF}" --format json --output "trivy-${IMAGE_NAME}-amd64.json" \
+          --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
     - name: Evaluate Trivy results (amd64)
       shell: bash
@@ -332,16 +343,13 @@ runs:
 
     - name: Trivy scan (arm64)
       if: github.event_name != 'pull_request' && inputs.enable-arm64 == 'true'
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-      with:
-        image-ref: ${{ steps.scan-ref.outputs.ref_arm64 }}
-        format: json
-        output: trivy-${{ inputs.image-name }}-arm64.json
-        exit-code: "0"
-        severity: CRITICAL,HIGH
-        trivyignores: .github/.trivyignore.yaml
-        # renovate: datasource=github-releases depName=aquasecurity/trivy
-        version: v0.70.0
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        SCAN_REF: ${{ steps.scan-ref.outputs.ref_arm64 }}
+      run: |
+        trivy image "${SCAN_REF}" --format json --output "trivy-${IMAGE_NAME}-arm64.json" \
+          --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
     - name: Evaluate Trivy results (arm64)
       if: github.event_name != 'pull_request' && inputs.enable-arm64 == 'true'
@@ -362,16 +370,13 @@ runs:
 
     - name: Trivy SARIF scan (amd64)
       if: always()
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-      with:
-        image-ref: ${{ steps.scan-ref.outputs.ref_amd64 }}
-        format: sarif
-        output: trivy-${{ inputs.image-name }}-amd64.sarif
-        exit-code: "0"
-        severity: CRITICAL,HIGH
-        trivyignores: .github/.trivyignore.yaml
-        # renovate: datasource=github-releases depName=aquasecurity/trivy
-        version: v0.70.0
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        SCAN_REF: ${{ steps.scan-ref.outputs.ref_amd64 }}
+      run: |
+        trivy image "${SCAN_REF}" --format sarif --output "trivy-${IMAGE_NAME}-amd64.sarif" \
+          --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
     - name: Upload SARIF amd64 to GitHub Security
       if: always()
@@ -382,16 +387,13 @@ runs:
 
     - name: Trivy SARIF scan (arm64)
       if: always() && github.event_name != 'pull_request' && inputs.enable-arm64 == 'true'
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-      with:
-        image-ref: ${{ steps.scan-ref.outputs.ref_arm64 }}
-        format: sarif
-        output: trivy-${{ inputs.image-name }}-arm64.sarif
-        exit-code: "0"
-        severity: CRITICAL,HIGH
-        trivyignores: .github/.trivyignore.yaml
-        # renovate: datasource=github-releases depName=aquasecurity/trivy
-        version: v0.70.0
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        SCAN_REF: ${{ steps.scan-ref.outputs.ref_arm64 }}
+      run: |
+        trivy image "${SCAN_REF}" --format sarif --output "trivy-${IMAGE_NAME}-arm64.sarif" \
+          --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
     - name: Upload SARIF arm64 to GitHub Security
       if: always() && github.event_name != 'pull_request' && inputs.enable-arm64 == 'true'

.github/workflows/docker.yml

@@ -532,6 +532,7 @@ jobs:
           base-image-digest: ${{ needs.build-backend-base-publish.outputs.digest }}
           base-image-artifact-name: ${{ needs.build-backend-base.outputs.artifact-name }}
           base-image-tarball-name: ${{ needs.build-backend-base.outputs.tarball-name }}
+          trivy-version: ${{ env.TRIVY_VERSION }}
           # ``LOGFIRE_PROJECT_TOKEN`` is the GHA repo secret; the
           # Dockerfile's ``embed_logfire_token.py`` step writes it
           # into ``_embedded_token.py`` before ``uv sync`` packages
@@ -810,35 +811,35 @@ jobs:
         run: echo "ref=ghcr.io/aureliolo/synthorg-web:sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
 
       - name: Report image size
-        run: scripts/report-image-size.sh "${{ steps.scan-ref.outputs.ref }}" "Web"
+        env:
+          SCAN_REF: ${{ steps.scan-ref.outputs.ref }}
+        run: scripts/report-image-size.sh "${SCAN_REF}" "Web"
+
+      - name: Install Trivy
+        run: |
+          curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
+          (cd /tmp && grep "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" trivy_checksums.txt | sha256sum -c -)
+          tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /tmp trivy
+          sudo install -m 0755 /tmp/trivy /usr/local/bin/trivy
 
       - name: Trivy scan
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          image-ref: ${{ steps.scan-ref.outputs.ref }}
-          format: json
-          output: trivy-web.json
-          exit-code: "0"
-          severity: CRITICAL,HIGH
-          trivyignores: .github/.trivyignore.yaml
-          # renovate: datasource=github-releases depName=aquasecurity/trivy
-          version: v0.70.0
+        env:
+          SCAN_REF: ${{ steps.scan-ref.outputs.ref }}
+        run: |
+          trivy image "${SCAN_REF}" --format json --output trivy-web.json \
+            --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
       - name: Evaluate Trivy results
         run: scripts/evaluate-scan.sh --verbose trivy-web.json "Web"
 
       - name: Trivy SARIF scan (web)
         if: always()
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          image-ref: ${{ steps.scan-ref.outputs.ref }}
-          format: sarif
-          output: trivy-web.sarif
-          exit-code: "0"
-          severity: CRITICAL,HIGH
-          trivyignores: .github/.trivyignore.yaml
-          # renovate: datasource=github-releases depName=aquasecurity/trivy
-          version: v0.70.0
+        env:
+          SCAN_REF: ${{ steps.scan-ref.outputs.ref }}
+        run: |
+          trivy image "${SCAN_REF}" --format sarif --output trivy-web.sarif \
+            --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml
 
       - name: Upload SARIF to GitHub Security (web)
         if: always()
@@ -948,6 +949,7 @@ jobs:
           base-image-digest: ${{ needs.build-sandbox-base-publish.outputs.digest }}
           base-image-artifact-name: ${{ needs.build-sandbox-base.outputs.artifact-name }}
           base-image-tarball-name: ${{ needs.build-sandbox-base.outputs.tarball-name }}
+          trivy-version: ${{ env.TRIVY_VERSION }}
 
   build-sandbox-publish:
     name: Publish Sandbox
@@ -1010,6 +1012,7 @@ jobs:
           base-image-digest: ${{ needs.build-sidecar-base-publish.outputs.digest }}
           base-image-artifact-name: ${{ needs.build-sidecar-base.outputs.artifact-name }}
           base-image-tarball-name: ${{ needs.build-sidecar-base.outputs.tarball-name }}
+          trivy-version: ${{ env.TRIVY_VERSION }}
 
   build-sidecar-publish:
     name: Publish Sidecar
@@ -1096,6 +1099,7 @@ jobs:
           enable-arm64: "false"
           cache-scope: fine-tune-${{ matrix.variant }}
           free-disk-space: "true"
+          trivy-version: ${{ env.TRIVY_VERSION }}
 
   build-fine-tune-publish:
     name: Publish Fine-Tune