From c9b24ada7891a30f87bcfd5a21f11b9172dcbb3c Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Wed, 6 May 2026 22:39:49 +0800
Subject: [PATCH] ci: add Trivy container vulnerability scan to release
 pipeline

Scans the amd64 Docker image for CRITICAL/HIGH CVEs with available fixes
before publishing multi-arch manifests. Results upload to GitHub Security tab
as SARIF. Blocks release if fixable vulnerabilities are found.
---
 .github/workflows/release.yml | 52 ++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2fafe3a2..df67c14e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,7 @@ permissions:
   issues: write
   pull-requests: write
   packages: write
+  security-events: write
 
 jobs:
   release:
@@ -128,9 +129,58 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  scan:
+    name: Trivy Container Scan
+    needs: [release, docker]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download amd64 digest
+        uses: actions/download-artifact@v4
+        with:
+          name: digests-linux-amd64
+          path: /tmp/digests
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
+      - name: Get digest
+        id: digest
+        run: |
+          sha=$(ls /tmp/digests | head -1)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.29.0
+        with:
+          image-ref: "ghcr.io/snapotter-hq/snapotter@sha256:${{ steps.digest.outputs.sha }}"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload results to GitHub Security
+        if: always()
+        uses: aquasecurity/trivy-action@v0.29.0
+        with:
+          image-ref: "ghcr.io/snapotter-hq/snapotter@sha256:${{ steps.digest.outputs.sha }}"
+          format: "sarif"
+          output: "trivy-results.sarif"
+          ignore-unfixed: true
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: "trivy-results.sarif"
+
   manifest:
     name: Create Multi-Arch Manifests
-    needs: [release, docker]
+    needs: [release, docker, scan]
     runs-on: ubuntu-latest
     steps:
       - name: Download digests