Enable Trivy container CVE scan (ENG-314)

[dblane-digicatapult]

Pull Request

Checklist

• Have you read Digital Catapult's Code of Conduct?
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.

PR Type

• Bug Fix
• Chore
• Feature

Linked tickets

ENG-314

High level description

Enables the new opt-in Trivy container CVE scan by setting scan_container: true on the shared build-docker call. The built linux/amd64 image is scanned with a digest-pinned Trivy and the build fails on CRITICAL findings; a JSON report is uploaded as an artifact (no GHAS upload).

Detailed description

Sets `scan_container: true` on the `build-docker` job in `test.yml`.

Branch pin: the build-docker uses: reference points at @ENG-314-container-scan until shared-workflows#112 merges, then flips to @main.

Describe alternatives you've considered

A standalone container-scan workflow — rejected in favour of folding the scan into build-docker so it reuses the existing build and applies wherever build-docker runs.

Operational impact

CI-only. Adds an amd64 image export to the existing build job and one isolated scan-image job (contents: read, no secrets). Fails the build on CRITICAL image CVEs.

Additional context

Part of the ENG-314 rollout alongside the shared-workflows change and the other caller repos.

[Copilot]

Pull request overview

Executive summary (≤10 lines)

This PR opts the repo into the shared build-docker reusable workflow’s new Trivy-based container CVE scan by setting scan_container: true, and bumps the package version accordingly. The main risk is CI supply-chain/reproducibility due to pinning the reusable workflow to a mutable branch ref, plus overbroad token permissions for the job. Merge should be held until the workflow reference is SHA-pinned (or moved to @main once merged upstream).

Changes:

• Enable opt-in container CVE scanning via scan_container: true for the shared build-docker workflow call.
• Temporarily pin the shared workflow reference to @ENG-314-container-scan.
• Bump package version 0.20.18 → 0.20.19 (package + lockfile).

Blockers (Must-Fix)

• .github/workflows/test.yml:93 — Reusable workflow call is pinned to a mutable branch ref (@ENG-314-container-scan) instead of an immutable SHA (supply-chain + reproducibility risk).
• .github/workflows/test.yml:94-99 — Job permissions include security-events: write / packages: write despite default shared-workflow inputs implying no push and no SARIF upload path; tighten to least privilege.

Targeted suggestions

• Pin the reusable workflow to the shared-workflows PR head SHA (then later switch to @main once merged).
• Reduce build-docker job permissions to the minimal set needed for the chosen shared workflow inputs.

Test gap analysis

• Not applicable (CI/workflow configuration + version bump only).

Integration risks

• CI may start failing on existing CRITICAL image CVEs once scan_container: true is enabled; expect initial triage work and possible remediation/allowlisting decisions upstream (in shared workflow inputs), depending on image contents.

Scores (rubric)

Category	Score (/10)	Reason
Correctness	8	Wiring matches shared workflow input; version bump consistent across lockfile.
Security	5	Mutable branch pin for workflow call; permissions not least-privilege.
Testing	8	No code-path change requiring tests.
Maintainability	7	Temporary branch pin adds follow-up burden; otherwise straightforward.
Performance	7	Adds scan work to CI; expected but increases runtime.
Integration/Infra	6	CI gating on CRITICAL CVEs can introduce new failure mode.
Overall	6.8	Address workflow pinning + permissions before approval.

Release notes draft

• Enable opt-in Trivy container vulnerability scanning in CI for built images.
• CI now fails builds on CRITICAL container CVEs (when scanning is enabled).
• Bump package version to 0.20.19.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
package.json	Bumps package version to align with release/CI expectations.
package-lock.json	Keeps lockfile version metadata in sync with package version bump.
.github/workflows/test.yml	Opts into shared-workflow Trivy scan by enabling scan_container.