fix(lmeval): auto-inject cluster CA bundle for HTTPS endpoints; allow re-run after spec change #818

	---
	name: Tier 1 - Security scan

	on:
	pull_request:
	branches: [main, incubation, stable]
	push:
	branches: [main, incubation, stable]

	jobs:
	trivy-scan:
	name: Trivy Security Scan
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	actions: read

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v4
	with:
	go-version-file: "go.mod"

	- name: Run Trivy vulnerability scan
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
	with:
	scan-type: "fs"
	scan-ref: "."
	format: "sarif"
	output: "trivy-results.sarif"
	severity: "CRITICAL,HIGH,MEDIUM,LOW"
	exit-code: "0"
	cache: "true"

	- name: Check for critical and high vulnerabilities
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
	with:
	scan-type: "fs"
	scan-ref: "."
	format: "table"
	severity: "CRITICAL,HIGH"
	exit-code: "1"
	cache: "true"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
	if: always()
	with:
	sarif_file: "trivy-results.sarif"
	category: "trivy-security-scan"

Provide feedback