Replace Trivy with OSV-Scanner and switch docs from pipx to uv

.github/workflows/ci.yml

@@ -75,28 +75,6 @@ jobs:
         pip install -e ".[dev]"
         pip install safety detect-secrets bandit
 
-    - name: Run Trivy filesystem scan
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: '.'
-        format: 'table'
-
-    - name: Run Trivy filesystem scan (JSON report)
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: '.'
-        format: 'json'
-        output: 'trivy-fs-results.json'
-
-    - name: Upload Trivy filesystem results
-      uses: actions/upload-artifact@v4
-      if: always()
-      with:
-        name: trivy-fs-results
-        path: trivy-fs-results.json
-
     - name: Run bandit security linter
       run: |
         bandit -r src/ -c pyproject.toml
@@ -109,10 +87,18 @@ jobs:
       run: |
         detect-secrets scan --baseline .secrets.baseline
 
+  osv-scan:
+    name: OSV-Scanner Vulnerability Scan
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
   build:
     name: Build Package
     runs-on: ubuntu-latest
-    needs: [test, security]
+    needs: [test, security, osv-scan]
 
     steps:
     - uses: actions/checkout@v4
@@ -131,70 +117,9 @@ jobs:
       run: |
         python -m build
 
-    - name: Run Trivy scan on built package
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: 'dist/'
-        format: 'table'
-
-    - name: Run Trivy scan on built package (JSON report)
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: 'dist/'
-        format: 'json'
-        output: 'trivy-package-results.json'
-
-    - name: Upload Trivy package results
-      uses: actions/upload-artifact@v4
-      if: always()
-      with:
-        name: trivy-package-results
-        path: trivy-package-results.json
-
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
         name: dist
         path: dist/
 
-  # Container security scan job - uncomment when you add Docker support
-  # container-security:
-  #   name: Container Security Scan
-  #   runs-on: ubuntu-latest
-  #   needs: [build]
-  #
-  #   steps:
-  #   - uses: actions/checkout@v4
-  #
-  #   - name: Build Docker image
-  #     run: |
-  #       docker build -t py_plate:latest .
-  #
-  #   - name: Run Trivy container scan
-  #     uses: aquasecurity/trivy-action@master
-  #     with:
-  #       image-ref: 'py_plate:latest'
-  #       format: 'sarif'
-  #       output: 'trivy-container-results.sarif'
-  #
-  #   - name: Upload Trivy container scan results to GitHub Security tab
-  #     uses: github/codeql-action/upload-sarif@v3
-  #     if: always()
-  #     with:
-  #       sarif_file: 'trivy-container-results.sarif'
-  #
-  #   - name: Run Trivy container scan (JSON report)
-  #     uses: aquasecurity/trivy-action@master
-  #     with:
-  #       image-ref: 'py_plate:latest'
-  #       format: 'json'
-  #       output: 'trivy-container-results.json'
-  #
-  #   - name: Upload Trivy container results
-  #     uses: actions/upload-artifact@v4
-  #     if: always()
-  #     with:
-  #       name: trivy-container-results
-  #       path: trivy-container-results.json

.github/workflows/release.yml

@@ -36,10 +36,18 @@ jobs:
         ruff format --check
         mypy src/
 
+  osv-scan:
+    name: OSV-Scanner Vulnerability Scan
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
   build:
     name: Build and publish
     runs-on: ubuntu-latest
-    needs: test
+    needs: [test, osv-scan]
     environment:
       name: release
       url: https://pypi.org/p/py_plate
@@ -69,22 +77,6 @@ jobs:
       run: |
         pip install safety bandit detect-secrets
 
-    - name: Run Trivy filesystem scan
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: '.'
-        format: 'json'
-        output: 'trivy-fs-results.json'
-
-    - name: Run Trivy package scan
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: 'dist/'
-        format: 'json'
-        output: 'trivy-package-results.json'
-
     - name: Run bandit security scan
       run: |
         bandit -r src/ -f json -o bandit-results.json || true
@@ -110,8 +102,6 @@ jobs:
           --draft=false \
           --prerelease=false \
           dist/* \
-          trivy-fs-results.json \
-          trivy-package-results.json \
           bandit-results.json \
           safety-results.json \
           secrets-scan-results.json

README.md

@@ -14,7 +14,7 @@ A modern Python CLI template with best practices, featuring Typer, Ruff, pre-com
 - 🔧 **Development tools** with [Ruff](https://docs.astral.sh/ruff/) for linting and formatting
 - 🛡️ **Security** with pre-commit hooks and secret detection
 - 🧪 **Testing** with pytest and coverage reporting
-- 📦 **Easy installation** with pipx support
+- 📦 **Easy installation** with uv support
 - 🎯 **Type safety** with mypy
 - 📋 **Code quality** with comprehensive linting rules
 - 🚀 **CI/CD** with GitHub Actions for testing, linting, and releases
@@ -24,10 +24,10 @@ A modern Python CLI template with best practices, featuring Typer, Ruff, pre-com
 
 This template includes comprehensive security scanning tools that run automatically in CI/CD pipelines and can be used during development:
 
-- **[Trivy](https://trivy.dev/)** - Vulnerability scanner for filesystems, containers, and packages
+- **[OSV-Scanner](https://osv.dev/)** - Vulnerability scanner based on the OSV.dev database
   - Scans for known vulnerabilities in dependencies
-  - Generates detailed security reports in multiple formats
-  - Integrated into CI pipeline and release artifacts
+  - Uploads results to the GitHub Security tab via SARIF
+  - Integrated into CI pipeline and as a release gate
 
 - **[Bandit](https://bandit.readthedocs.io/)** - Security linter for Python code
   - Identifies common security issues in Python code
@@ -46,35 +46,37 @@ This template includes comprehensive security scanning tools that run automatica
 
 All security tools generate JSON reports that are included as artifacts in GitHub releases, providing transparency and audit trails for security compliance.
 
-## 🚀 Quick Start with pipx
+## 🚀 Quick Start with uv
 
-[pipx](https://pypa.github.io/pipx/) is the recommended way to install Python CLI applications. It installs packages in isolated environments while making their entry points available globally.
+[uv](https://docs.astral.sh/uv/) is the recommended way to install Python CLI applications. Its `uv tool` command installs packages in isolated environments while making their entry points available globally.
 
-### Install pipx (if not already installed)
+### Install uv (if not already installed)
 
 ```bash
-# On macOS
-brew install pipx
+# On macOS and Linux
+curl -LsSf https://astral.sh/uv/install.sh | sh
 
-# On Ubuntu/Debian
-sudo apt update && sudo apt install pipx
+# On macOS with Homebrew
+brew install uv
 
-# On other systems with pip
-python3 -m pip install --user pipx
-python3 -m pipx ensurepath
+# On Windows
+powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
+
+# With pip
+pip install uv
 ```
 
 ### Install the CLI
 
 ```bash
 # Install from PyPI (when published)
-pipx install py-plate-template
+uv tool install py-plate-template
 
 # Or install from local directory
-pipx install .
+uv tool install .
 
 # Or install in development mode
-pipx install --editable .
+uv tool install --editable .
 ```
 
 ### Usage
@@ -105,7 +107,7 @@ py-plate config --set debug true
 ### Prerequisites
 
 - Python 3.9 or higher
-- pip or pipx
+- uv (recommended) or pip
 
 ### Development Installation
 
@@ -117,8 +119,10 @@ cd py_plate
 # Install in development mode with all dependencies
 pip install -e ".[dev]"
 
-# Or use pipx for isolated development
-pipx install --editable ".[dev]"
+# Or use uv for isolated development
+uv venv
+source .venv/bin/activate
+uv pip install -e ".[dev]"
 ```
 
 ### Set up pre-commit hooks

SECURITY.md

@@ -48,7 +48,7 @@ Please include the following information in your report:
 
 py_plate implements several security measures:
 
-- **Dependency Scanning**: Automated vulnerability scanning of dependencies using Safety and Trivy
+- **Dependency Scanning**: Automated vulnerability scanning of dependencies using Safety and OSV-Scanner
 - **Static Analysis**: Code security analysis using Bandit
 - **Secret Detection**: Automated detection of exposed secrets using detect-secrets
 - **Pre-commit Hooks**: Security checks run before each commit