ci: add Trivy security gates and container SBOM

[KostasCherv]

Summary

• replace the main-only Docker build job with a security job that runs after backend and UI checks on every pull request and push to main
• build the exact production image and scan it with Trivy for vulnerabilities, misconfigurations, and embedded secrets
• scan repository lockfiles, dependencies, configuration, and secrets with the same policy
• generate a CycloneDX SBOM for the built image and retain it as a workflow artifact for 30 days
• document the supply-chain security policy and SBOM artifact in the production deployment guide

Rationale

A successful unit-test run does not establish that the shipped dependency graph and container are safe. This adds a small, vendor-neutral release gate around the existing build without introducing a service or a second scanner.

The gate blocks actionable HIGH/CRITICAL findings. Vulnerabilities without an available fix remain visible but do not block delivery, avoiding permanent red builds for issues the project cannot remediate yet. HIGH/CRITICAL misconfiguration and secret findings remain blocking.

Third-party actions are pinned to immutable commit SHAs. Dependabot already monitors GitHub Actions and dependency ecosystems, so updates stay visible through the existing maintenance path.

Impact

• PRs now build and security-scan the production image after backend and UI checks pass.
• CI may take several additional minutes while building the image and fetching Trivy databases; Trivy's action caches its vulnerability database.
• Each successful image build produces cortex-sbom-<commit-sha> as a CycloneDX JSON artifact retained for 30 days.
• Fixable HIGH/CRITICAL findings will fail the security job and must be remediated or explicitly reviewed before merge.

Checks

• git diff --check
• parsed .github/workflows/ci.yml with PyYAML
• verified all configured inputs against aquasecurity/trivy-action v0.36.0 action metadata
• ran graphify update . successfully (2,679 nodes / 6,095 edges)
• attempted the production Docker build; local validation reached the external ghcr.io/astral-sh/uv metadata fetch, but the registry did not respond in this environment
• attempted a local Trivy filesystem scan with v0.70.0; the vulnerability DB registry similarly did not respond, so GitHub Actions remains the authoritative end-to-end validation

[KostasCherv]

Security gate validation

The first run correctly blocked nine existing fixable HIGH findings. This branch now also updates only the affected lockfile entries:

• Python: cryptography 48.0.1, langsmith 0.8.18, PyJWT 2.13.0, python-multipart 0.0.30, soupsieve 2.8.4, and starlette 1.3.1
• UI transitive dependency: ws 8.21.0

Validation after remediation:

• backend: pass (554 tests)
• UI: pass (5 files / 8 tests)
• repository Trivy gate: pass
• image build, CycloneDX SBOM generation/upload, and image Trivy gate: pass

GitHub Actions run: https://github.com/KostasCherv/cortex/actions/runs/29191102901

[KostasCherv]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: ce2f319ca8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cortex	Ready	Preview, Comment	Jul 14, 2026 8:41am