ci: limit Trivy scan uploads to critical and high severity findings #3

	name: Security Scanning

	on:
	schedule:
	# Run daily at midnight UTC
	- cron: "0 0 * * *"
	push:
	branches:
	- main
	pull_request:

	permissions:
	contents: read
	security-events: write

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	trivy-source:
	name: Trivy Source Code Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v5
	with:
	fetch-depth: 0

	- name: Run Trivy vulnerability scanner in repo mode
	uses: aquasecurity/[email protected]
	with:
	scan-type: "fs"
	ignore-unfixed: true
	format: "sarif"
	output: "trivy-source-results.sarif"
	severity: "CRITICAL,HIGH"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-source-results.sarif"

Provide feedback