From a73607ce22cf6d48aa35f4bdfe2f180022666915 Mon Sep 17 00:00:00 2001
From: gmegidish <gil@megidish.net>
Date: Wed, 15 Apr 2026 11:39:51 +0200
Subject: [PATCH] ci: merge trivy scan into build.yml as separate job

---
 .github/workflows/build.yml | 16 ++++++++++++++++
 .github/workflows/trivy.yml | 27 ---------------------------
 2 files changed, 16 insertions(+), 27 deletions(-)
 delete mode 100644 .github/workflows/trivy.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4f78765..e4b8c71 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -49,6 +49,22 @@ jobs:
         path: build/export/*-Sim-*.zip
         retention-days: 4
 
+  trivy:
+    runs-on: macos-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v5
+
+    - name: Install trivy
+      env:
+        TRIVY_VERSION: 0.69.3
+      run: |
+        curl -sfL https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_macOS-ARM64.tar.gz | tar xz -C /usr/local/bin trivy
+
+    - name: Run trivy
+      run: trivy fs --severity HIGH,CRITICAL .
+
   release:
     needs: build
     if: github.ref_type == 'tag' && github.event_name == 'push'
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
deleted file mode 100644
index 45726eb..0000000
--- a/.github/workflows/trivy.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: Trivy Security Scan
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-permissions:
-  contents: read
-
-jobs:
-  scan:
-    runs-on: macos-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v5
-
-    - name: Install trivy
-      env:
-        TRIVY_VERSION: 0.69.3
-      run: |
-        curl -sfL https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_macOS-ARM64.tar.gz | tar xz -C /usr/local/bin trivy
-
-    - name: Run trivy
-      run: trivy fs --severity HIGH,CRITICAL .