Re-enable license scan using trivy CLI directly instead of trivy-action

[mendral-app]

Summary

• Re-enables license scanning in CI which was fully disabled as a workaround for aquasecurity/trivy-action not correctly applying ignore files during license scans
• Replaces the commented-out trivy-action step with a direct trivy fs CLI invocation that reliably respects .trivyignore.yaml, ensuring the reviewed n8n package licenses (SEE LICENSE IN LICENSE.md) are properly suppressed
• Installs Trivy via the official apt repository in the test job since the runner (ubuntu-22.04) doesn't have it pre-installed

What changed

In .github/workflows/make.yaml (test job):

• Removed the commented-out aquasecurity/trivy-action block (lines 187-195)
• Added an "Install Trivy" step using the official Trivy apt repository
• Added a "Scan licenses" step running trivy fs . --scanners license --severity UNKNOWN,HIGH,CRITICAL --exit-code 1 --ignorefile .trivyignore.yaml

Why

The trivy-action GitHub Action wrapper has known issues with ignore file handling for license scanning. The direct CLI invocation correctly processes .trivyignore.yaml, which contains the approved exception for n8n packages with SEE LICENSE IN LICENSE.md licenses.

Without this fix, no license scanning was running in CI at all — any new dependency with a problematic license would go undetected.

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session
• Addresses this insight

---

Summary by cubic

Re-enables CI license scanning by replacing aquasecurity/trivy-action with a direct trivy fs run that honors .trivyignore.yaml. Adds a Rego policy to allow CC-BY-SA-4.0 only for internal @probo/vendors, keeping failures for third‑party packages.

• Bug Fixes
  • Install trivy from the official apt repo in the test job on ubuntu-22.04.
  • Run trivy fs with --scanners license, --severity UNKNOWN,HIGH,CRITICAL, --exit-code 1, --ignorefile .trivyignore.yaml, and --ignore-policy .trivy-license-policy.rego.

^{Written for commit 9c9fab3. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".trivyignore.yaml">

<violation number="1" location=".trivyignore.yaml:10">
P2: This exception is broader than the comment suggests: it ignores all `CC-BY-SA-4.0` findings from `package-lock.json`, not just `@probo/vendors`. That weakens the re-enabled license scan by hiding future third-party packages with the same license.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/make.yaml">

<violation number="1" location=".github/workflows/make.yaml:201">
P1: This policy hook won't suppress the `@probo/vendors` finding because the Rego rule matches `CC-BY-SA-4.0`, while the lockfile license string is `CC BY-SA 4.0`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}