Three CodeRabbit findings on #282 were deliberately left out of that PR, whose scope was restoring the deploy workflow so it runs at all. Capturing them here so they are not lost.
1. Pin GitHub Actions to commit SHAs
aquasecurity/trivy-action@master is the priority — a mutable branch reference in the step that gates deploys, so an upstream change lands in the security gate with no review. actions/checkout@v4 and actions/setup-java@v4 are tags, better but still mutable.
Should be done across every workflow at once and paired with Dependabot (package-ecosystem: github-actions), otherwise pinning trades a supply-chain risk for stale, unpatched actions.
2. Deploy the commit that was scanned
deploy.yml runs git pull origin "$BRANCH" on the server, so it builds whatever the branch tip is at that moment — not the commit trivy-scan just approved. Any merge landing between the scan and the deploy ships unscanned code.
Fix is to pass github.sha through to the script and git fetch && git reset --hard <sha> instead of pulling the tip. Changes deployment semantics, so it wants testing against a real deploy.
3. Decide on ignore-unfixed: true
Currently Trivy only fails on vulnerabilities that have a fix available. Defensible — the alternative fails deploys on things nobody can act on — but it should be a conscious policy decision rather than an inherited default. Worth revisiting alongside a .trivyignore with expiry dates for accepted findings.
Context: automatic deploys were dead from 2026-07-07 to the merge of #282 because the workflow file had lost its header. 115 commits accumulated undeployed in that window. Worth a look at whether a failed or missing deploy can be made to alert someone, so a five-week outage cannot repeat silently.
Three CodeRabbit findings on #282 were deliberately left out of that PR, whose scope was restoring the deploy workflow so it runs at all. Capturing them here so they are not lost.
1. Pin GitHub Actions to commit SHAs
aquasecurity/trivy-action@masteris the priority — a mutable branch reference in the step that gates deploys, so an upstream change lands in the security gate with no review.actions/checkout@v4andactions/setup-java@v4are tags, better but still mutable.Should be done across every workflow at once and paired with Dependabot (
package-ecosystem: github-actions), otherwise pinning trades a supply-chain risk for stale, unpatched actions.2. Deploy the commit that was scanned
deploy.ymlrunsgit pull origin "$BRANCH"on the server, so it builds whatever the branch tip is at that moment — not the committrivy-scanjust approved. Any merge landing between the scan and the deploy ships unscanned code.Fix is to pass
github.shathrough to the script andgit fetch && git reset --hard <sha>instead of pulling the tip. Changes deployment semantics, so it wants testing against a real deploy.3. Decide on
ignore-unfixed: trueCurrently Trivy only fails on vulnerabilities that have a fix available. Defensible — the alternative fails deploys on things nobody can act on — but it should be a conscious policy decision rather than an inherited default. Worth revisiting alongside a
.trivyignorewith expiry dates for accepted findings.Context: automatic deploys were dead from 2026-07-07 to the merge of #282 because the workflow file had lost its header. 115 commits accumulated undeployed in that window. Worth a look at whether a failed or missing deploy can be made to alert someone, so a five-week outage cannot repeat silently.