Fix Trivy action ref and tighten CI security documentation.

Use aquasecurity/trivy-action v0.36.0 (SHA-pinned); tags require a
v prefix. Clarify docs and workflow comments without internal tracker refs.

Author: armanfeyzi

.github/workflows/ci.yml

@@ -1,6 +1,5 @@
 # CI for helm-watch.
-# Security scans (gitleaks, Semgrep, Trivy image) run in report-only mode until ARM-6 enables gates.
-# See docs/ci-security.md.
+# Optional security jobs (gitleaks, Semgrep, Trivy) run in report-only mode; see docs/ci-security.md.
 
 name: CI
 
@@ -101,7 +100,7 @@ jobs:
           path: dist/helm-watch-image.tar
 
   security-static:
-    name: Security — secrets & SAST (report-only)
+    name: Security — secrets (report-only)
     runs-on: ubuntu-latest
 
     steps:
@@ -147,15 +146,15 @@ jobs:
         run: docker load -i dist/helm-watch-image.tar
 
       - name: Trivy image scan (table)
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           image-ref: helm-watch:ci
           format: table
           severity: CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN
           exit-code: "0"
 
       - name: Trivy image scan (SARIF report)
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           image-ref: helm-watch:ci
           format: sarif

docs/ci-security.md

@@ -1,58 +1,56 @@
 # CI security scans (report-only)
 
-Helm Watch PR/push CI includes three **report-only** security jobs (Linear [ARM-5](https://linear.app/armanfeyzi/issue/ARM-5)). They run on every workflow but do **not** fail the build yet. Follow-up [ARM-6](https://linear.app/armanfeyzi/issue/ARM-6) turns on hard gates for secrets and critical image CVEs.
+Pull request and push workflows include optional security jobs that **report findings without failing CI**. This lets maintainers review noise levels before enabling enforcement gates.
 
 Workflow: [`.github/workflows/ci.yml`](../.github/workflows/ci.yml)
 
 ## Jobs overview
 
 | Job | Tools | What it checks |
 |-----|-------|----------------|
-| `security-static` | gitleaks | Git secrets |
-| `semgrep` | Semgrep (`semgrep/semgrep` image) | Go/Kubernetes SAST rules |
-| `container-security` | Trivy | CVEs and misconfig in the `helm-watch:ci` image |
-| `test-and-build` | gosec (existing) | Go-specific high-confidence SAST |
+| `security-static` | gitleaks | Secrets in git history |
+| `semgrep` | Semgrep (`semgrep/semgrep` image) | Go and security-audit SAST rules |
+| `container-security` | Trivy | CVEs in the `helm-watch:ci` image |
+| `test-and-build` | gosec (existing) | Go high-confidence SAST (enforced) |
 
-`container-security` depends on `test-and-build` and reuses the saved Docker image tarball.
+`container-security` depends on `test-and-build` and scans the Docker image artifact produced in that job.
 
 ## gitleaks (secrets)
 
-- **Why:** Catches API keys, tokens, and passwords committed to git — before they reach a public OSS repo or GHCR.
-- **How:** Scans full git history (`fetch-depth: 0`). Uses the default gitleaks ruleset.
-- **Report-only:** `continue-on-error: true` — findings appear in the job log; CI stays green.
-- **Later (ARM-6):** Remove `continue-on-error` so any leak fails the workflow.
+- **Purpose:** Detect API keys, tokens, and passwords in commits before they are published.
+- **Configuration:** Full git history (`fetch-depth: 0`), default gitleaks ruleset.
+- **Current behavior:** `continue-on-error: true` — findings are logged; the job does not fail CI.
+- **Planned enforcement:** Fail the workflow when any secret is detected.
 
 ## Semgrep (SAST)
 
-- **Why:** Broader static analysis than gosec alone (logic bugs, unsafe patterns, security anti-patterns in Go and YAML-adjacent rules).
-- **How:** Dedicated job using the official [`semgrep/semgrep`](https://hub.docker.com/r/semgrep/semgrep) container and `semgrep scan --config p/golang --config p/security-audit`. The legacy `semgrep/semgrep-action@v1` wrapper is deprecated and its `returntocorp/semgrep-agent` image is no longer pullable.
-- **Report-only:** `continue-on-error: true` (findings may still exit non-zero).
-- **Later (ARM-10):** Enable Semgrep `--error` / fail on ERROR severity after tuning false positives.
+- **Purpose:** Complement gosec with broader static rules for Go and common security anti-patterns.
+- **Configuration:** Job runs in the [`semgrep/semgrep`](https://hub.docker.com/r/semgrep/semgrep) container with `semgrep scan --config p/golang --config p/security-audit`.
+- **Current behavior:** `continue-on-error: true`.
+- **Planned enforcement:** Fail on ERROR-severity findings after false positives are triaged.
 
 ## Trivy (container image)
 
-- **Why:** The runtime image can include vulnerable OS packages or dependencies not visible in `go test`.
-- **How:** After `docker build`, the image is saved as an artifact, loaded in `container-security`, and scanned with `aquasecurity/trivy-action`. Table output goes to the log; SARIF is uploaded as `trivy-image-sarif` for optional review in GitHub / external tools.
-- **Report-only:** `exit-code: "0"` — never fails the job regardless of severity.
-- **Later (ARM-6):** Fail on CRITICAL and HIGH; use `.trivyignore` only for documented exceptions.
+- **Purpose:** Scan the runtime image for OS and dependency CVEs not covered by unit tests.
+- **Configuration:** [`aquasecurity/trivy-action`](https://github.com/aquasecurity/trivy-action) (pinned to a release SHA). Table output in logs; SARIF uploaded as `trivy-image-sarif`.
+- **Current behavior:** `exit-code: "0"` — results are informational only.
+- **Planned enforcement:** Fail on CRITICAL and HIGH severities, with `.trivyignore` for documented exceptions only.
 
-## What stays unchanged
+## Unchanged checks
 
-- **gosec** remains in `test-and-build` and already fails on high-severity Go issues.
-- **golangci-lint**, tests, Helm lint, and image build behavior are unchanged.
+- **gosec** in `test-and-build` continues to fail on high-severity Go issues.
+- Tests, golangci-lint, Helm lint, and image build steps are unchanged.
 
-## Reading results in GitHub Actions
+## Viewing results in GitHub Actions
 
-1. Open the CI run for your PR or push.
-2. Open **Security — secrets & SAST** or **Security — container image**.
-3. Expand the failing-looking steps — with report-only mode the job is still green; read the log for `leak`, `finding`, or Trivy `TOTAL`.
+1. Open the CI run for the branch or pull request.
+2. Inspect **Security — secrets**, **Security — SAST**, or **Security — container image**.
+3. Review step logs for gitleaks leaks, Semgrep rule IDs, or Trivy severity counts (jobs may show warnings while report-only mode is enabled).
 
-## Rollout plan (from practice lab)
+## Enforcement roadmap
 
-| Week | Change |
-|------|--------|
-| 1 (now) | Report-only: gitleaks, Semgrep, Trivy image |
-| 2 | Fail on gitleaks + Trivy CRITICAL/HIGH; add govulncheck (ARM-7) |
-| 3 | Semgrep error gate (ARM-10) |
-
-Training notes: see Notion page under **Practice · Lab CI/CD (GitHub Actions)** (helm-watch Week 1 implementation).
+| Phase | Change |
+|-------|--------|
+| Current | Report-only gitleaks, Semgrep, and Trivy image scans |
+| Next | Fail CI on secret leaks and Trivy CRITICAL/HIGH |
+| Later | Dependency scanning (govulncheck); Semgrep ERROR gate |