From ac39557b429cfa00a0027a2d0f6a2af91b1f31be Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Mon, 8 Jun 2026 17:45:40 +0800
Subject: [PATCH] feat(ci): add Trivy JSON report as release artifact

Full vulnerability scan (all severities) uploaded to each GitHub
Release for enterprise customers to review before deployment.
---
 .github/workflows/release.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9a6387e5..4bffde1a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -254,7 +254,7 @@ jobs:
     needs: [release, docker]
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       packages: read
       security-events: write
     steps:
@@ -309,6 +309,25 @@ jobs:
         with:
           sarif_file: "trivy-results.sarif"
 
+      - name: Run Trivy (JSON report)
+        if: always()
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: "ghcr.io/snapotter-hq/snapotter@sha256:${{ steps.digest.outputs.sha }}"
+          format: "json"
+          output: "snapotter-v${{ needs.release.outputs.new_version }}-trivy.json"
+          ignore-unfixed: true
+
+      - name: Upload Trivy report to GitHub Release
+        if: always()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.release.outputs.new_version }}
+        run: |
+          gh release upload "v${VERSION}" \
+            "snapotter-v${VERSION}-trivy.json" \
+            --clobber --repo snapotter-hq/SnapOtter
+
   sbom:
     name: Generate SBOM
     needs: [release, docker]