ci(publish): unify image scanning across published images

[nicktrn]

What

Run the shared Trivy image scan on every published image through a single reusable workflow.

Changes

• Generalise the image-scan workflow (trivy-image-webapp.yml -> trivy-image.yml) - it was already parameterised by image-ref; only the run-summary label was image-specific.
• publish-worker-v4.yml: expose version + image_repo as workflow outputs (single-entry matrix, so unambiguous).
• publish.yml: run the shared scan from each publish job (scan-webapp, scan-supervisor).

Report-only (writes a table to the run summary), OS packages only (vuln-type: os - library deps stay with Dependabot), never blocks the publish.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 719fdc8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 5ca2f0a7-9752-49f9-9344-f0a61ce1b04d

📥 Commits

Reviewing files that changed from the base of the PR and between a7c734c and 719fdc8.

📒 Files selected for processing (3)

• .github/workflows/publish-worker-v4.yml
• .github/workflows/publish.yml
• .github/workflows/trivy-image.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: code-quality / code-quality
• GitHub Check: audit
• GitHub Check: Zizmor
• GitHub Check: audit
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (actions)

🔇 Additional comments (3)

.github/workflows/trivy-image.yml (1)

1-4: LGTM!

Also applies to: 30-32, 62-73

.github/workflows/publish-worker-v4.yml (1)

16-22: LGTM!

Also applies to: 48-52, 96-96

.github/workflows/publish.yml (1)

100-112: LGTM!

---

Walkthrough

The workflows now expose published image version and repository outputs from the worker build. The publish workflow invokes the shared Trivy image scanner for both webapp and supervisor images. The Trivy workflow has been generalized from webapp-specific usage, including its name, concurrency key, report filename, and job summary output.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description omits required template sections like Closes #, checklist, testing, changelog, and screenshots.	Add the missing template sections: issue link, checklist items, testing steps, changelog, and screenshots or N/A notes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, specific, and matches the main change: unifying image scanning across published images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/unify-image-scanning

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.