Add Trivy filesystem scan to GitHub Actions

[Copilot]

Adds Trivy filesystem vulnerability scanning to the CI pipeline, scanning lockfiles and dependencies for CRITICAL/HIGH severity issues with results surfaced in the GitHub Security tab.

Changes

• .github/workflows/trivy.yml — New workflow: fs scan on push/PR to develop/main, SARIF upload to Security tab. Pinned to aquasecurity/trivy-action@v0.35.0 (57a97c7...) — the only uncompromised release post CVE-2026-33634 supply chain attack.
• docs/security/code-security.md — Added Trivy to required controls list.
• docs/security/github-required-checks.md — Added trivy-fs-scan as intended required check for both develop and main.

Notes

All actions are commit-SHA pinned per repo dependency policy. Reuses the same actions/checkout and codeql-action/upload-sarif SHAs already in use by existing workflows.

Original prompt

Trivy Scan 추가를 GitHub Actions에 추가해 주세요.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 55a59616-f85e-459b-ab52-b2ed46eb9bf7

📥 Commits

Reviewing files that changed from the base of the PR and between c373269 and 9502f8a.

📒 Files selected for processing (1)

• .github/workflows/trivy.yml

Cache: Disabled due to Reviews > Disable Cache setting

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Summary by CodeRabbit

릴리스 노트

• Chores

  • 자동화된 파일시스템 취약점 스캔 워크플로우가 추가되었습니다.

• Documentation

  • 코드 보안 제어 문서에 새 파일시스템 취약점 스캔 항목이 추가되었습니다.
  • 병합 게이트 필수 검사 목록에 해당 스캔 상태 검사가 포함되어 검토 및 병합 요구사항이 강화되었습니다.

Walkthrough

새 GitHub Actions 워크플로우 .github/workflows/trivy.yml를 추가해 Trivy 파일시스템 취약점 스캔을 실행하고, 이 워크플로우를 보안 문서 및 develop/main 브랜치의 필수 병합 검사에 등록했습니다.

Changes

Cohort / File(s)	Summary
워크플로우 파일 .github/workflows/trivy.yml	새 워크플로우 trivy 추가. PR 및 push(대상: develop, main)에서 트리거되며 trivy-fs-scan 잡이 ubuntu-latest에서 파일시스템 스캔(scan-type: fs, scan-ref: '.')을 실행해 SARIF(trivy-results.sarif)로 출력, CRITICAL/HIGH만 포함하고 결과를 항상 업로드(if: always())합니다.
보안 문서 업데이트 docs/security/code-security.md, docs/security/github-required-checks.md	코드 보안 제어 목록에 Trivy filesystem vulnerability scan 추가 및 trivy-fs-scan을 develop/main 병합-gate 필수 체크에 등록했습니다.

Sequence Diagram(s)

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub Actions
    participant Runner as Actions Runner (ubuntu-latest)
    participant Trivy as Trivy Scanner
    participant SARIF as SARIF Upload (Security Tab)

    Dev->>GH: push / open PR targeting develop/main
    GH->>Runner: dispatch trivy-fs-scan job
    Runner->>Trivy: run fs scan (scan-ref='.', severities=CRITICAL,HIGH)
    Trivy-->>Runner: write `trivy-results.sarif` and return exit code (1 on findings)
    Runner->>SARIF: upload `trivy-results.sarif` via github/codeql-action/upload-sarif [if: always()]
    SARIF-->>GH: SARIF processed in Security tab

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Add Trivy filesystem scan to GitHub Actions #83 — 같은 trivy.yml 워크플로우, trivy-fs-scan 잡 및 관련 문서 변경을 포함해 직접적으로 연관됨.

Poem

🐇 새벽밭을 깡충이며 살핀다,
트리비 빛으로 틈을 찾아내고,
경고 깃발들 낮게 흔들리면,
나는 당당히 점프해 고쳐놓네,
안전한 밭에 당근 하나 남기리 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	제목은 풀 리퀘스트의 주요 변경사항인 Trivy 파일시스템 스캔을 GitHub Actions에 추가하는 내용을 명확하고 간결하게 요약합니다.
Description check	✅ Passed	설명은 변경사항의 모든 부분과 관련이 있으며, 구체적인 파일 변경, 설정 세부사항 및 보안 정책 준수를 포함합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch copilot/add-trivy-scan-to-github-actions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/trivy.yml:
- Around line 23-30: The Trivy scan step ("Run Trivy filesystem scan" using
aquasecurity/trivy-action) currently sets severity: CRITICAL,HIGH but misses the
SARIF filtering and fail-on-severity behavior; update the Trivy action step to
add limit-severities-for-sarif: true so the SARIF output is restricted to
CRITICAL/HIGH and add exit-code: '1' so the step fails when those severities are
found (keep existing keys like scan-type, scan-ref, format and output
unchanged).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: cd50e862-9a7b-44e9-84b8-dfc6c2eb7e77

📥 Commits

Reviewing files that changed from the base of the PR and between 6e93f87 and c373269.

📒 Files selected for processing (3)

• .github/workflows/trivy.yml
• docs/security/code-security.md
• docs/security/github-required-checks.md

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

All requested changes implemented in commit d370e10: added limit-severities-for-sarif: true and exit-code: '1' to trivy.yml