Test: trigger guard-skills workflow

.github/workflows/guard-skills.yml

@@ -4,11 +4,12 @@ on:
   pull_request:
     paths:
       - 'skills/**'
-      - '!skills/README.md'
       - 'providers/claude/plugin/skills/**'
       - 'providers/codex/plugin/skills/**'
       - 'providers/cursor/plugin/skills/**'
       - 'providers/grok/plugin/skills/**'
+    paths-ignore:
+      - 'skills/README.md'
 
 jobs:
   block:

.github/workflows/trivy-scan.yml

@@ -0,0 +1,29 @@
+name: Trivy security scan
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  trivy-scan:
+    name: Trivy filesystem scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@v0.2.0
+        with:
+          scan-type: fs
+          format: table
+          severity: CRITICAL,HIGH,MEDIUM
+
+      - name: Show summary (always)
+        if: always()
+        run: |
+          echo "Trivy step finished. Check the job log for details."

docs/trivy-integration.md

@@ -0,0 +1,16 @@
+Trivy integration (quick start)
+
+This repository now includes a GitHub Actions job (.github/workflows/trivy-scan.yml) that runs Trivy filesystem scans on pushes to main and on pull requests.
+
+Run locally (Docker):
+
+- Scan the repo directory and produce a table report:
+  docker run --rm -v "$(pwd)":/project aquasecurity/trivy:latest fs --severity CRITICAL,HIGH,MEDIUM -f table /project
+
+- Output JSON for further processing:
+  docker run --rm -v "$(pwd)":/project aquasecurity/trivy:latest fs --severity CRITICAL,HIGH,MEDIUM -f json -o /project/trivy-report.json /project
+
+CI notes:
+- The action used is aquasecurity/trivy-action; check job logs for scan output.
+- Adjust 'severity' in .github/workflows/trivy-scan.yml to change which severities trigger reporting.
+- For faster scans in CI, consider caching or targetting only changed files/directories.

skills/test-trigger.txt

@@ -0,0 +1 @@
+This is a test to trigger guard-skills workflow. Please ignore.