feat(debugger): Add event tracing and runtime diagnostics #96

	name: Trivy Security Scan

	on:
	pull_request:
	branches: [ "main" ]
	push:
	branches: [ "main" ]

	jobs:
	trivy:
	name: Trivy
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Generate Trivy SARIF (filesystem)
	uses: aquasecurity/trivy-action@v0.35.0
	with:
	scan-type: fs
	scan-ref: .
	format: sarif
	output: trivy-fs.sarif
	severity: HIGH,CRITICAL
	ignore-unfixed: true
	scanners: vuln,misconfig,secret
	trivy-config: trivy.yaml
	exit-code: '0'

	- name: Upload Trivy SARIF
	if: always() && hashFiles('trivy-fs.sarif') != ''
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: trivy-fs.sarif

	- name: Enforce Trivy filesystem gate
	uses: aquasecurity/trivy-action@v0.35.0
	with:
	scan-type: fs
	scan-ref: .
	format: table
	output: trivy-fs.txt
	severity: HIGH,CRITICAL
	ignore-unfixed: true
	scanners: vuln,misconfig,secret
	trivy-config: trivy.yaml
	exit-code: '1'

	- name: Enforce Dockerfile misconfiguration gate
	uses: aquasecurity/trivy-action@v0.35.0
	with:
	scan-type: config
	scan-ref: Picea.Abies.Conduit.AppHost/Dockerfile
	format: table
	output: trivy-dockerfile.txt
	severity: HIGH,CRITICAL
	exit-code: '1'

	- name: Upload Trivy artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: trivy-artifacts
	path: \|
	trivy-fs.sarif
	trivy-fs.txt
	trivy-dockerfile.txt

Provide feedback