ci(security): enforce Trivy severity gates

[appleboy]

Summary

The scheduled Trivy workflow reported success even when findings existed because it did not set a failing exit code. Enforce exit code 1 for HIGH/CRITICAL findings in both repository and image scans. Set limit-severities-for-sarif: true in both workflows so SARIF honors the declared severity policy; keep the existing always-run report upload.

No new vulnerability exclusions were added. Acceptance is the existing HIGH/CRITICAL policy, not absence of lower-severity findings.

Verification

Checkout fix/trivy-security-scan in appleboy/drone-telegram and run from the repository root. Prerequisites: Go 1.25.13, Docker with Linux/amd64 support, Trivy 0.70.0, actionlint 1.7.12, golangci-lint 2.12.0, network access to Go modules, Alpine packages and the vulnerability database.

export GOTOOLCHAIN=go1.25.13
make build_linux_amd64
docker build --pull --platform linux/amd64 --build-arg TARGETOS=linux --build-arg TARGETARCH=amd64 -f docker/Dockerfile -t drone-telegram:trivy-fix .
trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .
trivy image --image-src docker --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 drone-telegram:trivy-fix
actionlint -shellcheck= -pyflakes= .github/workflows/trivy.yml .github/workflows/docker.yml
golangci-lint run --timeout 5m
git diff --check

Observed: Linux/amd64 binary and image build succeeded; both Trivy scans exited 0 with zero HIGH/CRITICAL findings using the 2026-10-06 database; actionlint, Go lint and diff checks passed. Local fs scans excluded the unrelated .claude worktree directory.

GOTOOLCHAIN=go1.25.13 go test -timeout 180s ./...: passed.

Negative gate check passed: scanning a temporary module requiring x/crypto v0.45.0 with trivy fs --scanners vuln --severity HIGH,CRITICAL --exit-code 1 --format sarif returned exit 1 and still emitted SARIF findings. This validates the failure/report path. Review the retained if: always() upload steps. PR CI validates GitHub SARIF upload separately.

Cleanup: generated binaries are ignored under release/; the optional local image can be removed with docker image rm drone-telegram:trivy-fix.

AI authorship and review

• AI was used: Codex.
• AI-authored files: .github/workflows/docker.yml, .github/workflows/trivy.yml.
• Human line-by-line reviewed: None — not yet reviewed by a human.
• Classification: Leaf, scoped to this plugin’s build/dependency/security workflow; request one reviewer.

Scope, risk and rollback

Goal: remediate current scan findings and make recurring scans enforce the declared severity threshold. Risk: dependency/toolchain updates may affect runtime behavior; newly published HIGH/CRITICAL advisories will now correctly fail CI. Revert this commit to roll back, which also restores the previous security weaknesses. Review workflow gates and dependency/image version changes carefully; checksums are mechanical.

Related issues: none supplied.