feat: restore Trivy scanning via Socket-built distribution

[lelia]

What

Restores Trivy-backed scanning and overhauls the publish pipeline — the scope grew deliberately as part of the major-release batch:

1. Trivy restored via Socket-built distribution: main/heavy/app_tests images pull ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f1… (rebuilt from unmodified upstream source, digest-pinned, TRIVY_IMAGE override available). app_tests was still pulling aquasec/trivy:0.69.3 from Docker Hub by mutable tag — converted.
2. OSS toolchain refresh: TruffleHog 3.96.0, OpenGrep v1.26.0, uv 0.12.1, gosec v2.28.0, Go 1.26.5, Socket CLI 2.5.8. Runtime bases (python/node) deliberately deferred to their own PR.
3. Docker Hub creds scoped to the publish environment: merge-manifests binds the environment; build-test-push uses secrets: inherit with the reusable pipeline binding publish in push mode only (PR builds bind none). Repo-level DOCKERHUB_* secrets stay until the first publish validates the path, then get deleted.
4. latest/latest-heavy aliases reintroduced (flavor: latest=true): safe now that version tags are registry-immutable (^\d+\.\d+\.\d+(-heavy)?$ rule applied on Docker Hub). Dispatch re-publish documented as recovery-only.
5. Tests: smoke checks verify trivy presence + version-pin agreement + a functional trivy config scan in every image; new integration Test 4 runs the trivy connector end-to-end (--dockerfiles fixture) and explicitly fails on the connector's silent "Trivy not found" fallback.
6. app_tests resurrected: the image had never built since the layout migration (stale source COPYs, wrong build context, dereferenced npm symlinks, dead venv against a corrupt uv.lock) — all repaired; lockfile regenerated.
7. CI: unconditional GHCR login (+packages: read in callers) for the private base image; documented zizmor exception for secrets-inherit.
8. Docs: repo-wide removal of the "temporarily without Trivy" messaging; 0.69.4–0.69.6 warnings retained for native installs; APT generic fix; pinning guidance updated for the new alias.

No Python changes — the trivy connector is config-driven and needed none.

Reviewer notes

• Local builds need pull access to ghcr.io/socketdev/trivy; without it: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
• Release plan: separate self-contained 3.0.0 release PR (version refs + CHANGELOG only) after this merges; the tag-triggered publish is the live validation of the environment-secrets path and the new tag scheme.

---

Note

High Risk
Re-enables container scanning and changes release tagging (latest) plus credential scoping for production image publishes; incorrect pins or publish config could affect every consumer of the pre-built images.

Overview
Restores Trivy in the main, heavy, and app_tests images by sourcing a digest-pinned ghcr.io/socketdev/trivy base (TRIVY_IMAGE) instead of aquasec/trivy, with Dependabot no longer bumping Trivy independently. Tool pins move forward (e.g. TruffleHog, OpenGrep, uv, OpenGrep/gosec/Go in app tests) and docs/action.yml drop the “Trivy temporarily unavailable” wording while keeping native-install warnings for compromised 0.69.4–0.69.6 tags.

Publish and PR CI scope Docker Hub credentials to the publish environment (secrets: inherit, environment only on push), always log into GHCR with packages: read for the private Trivy base, and re-enable floating latest / latest-heavy alongside immutable semver tags. Smoke/integration tests now assert Trivy is present, matches the Dockerfile pin, and runs trivy config; app_tests builds from app_tests/ context with a fixed Dockerfile (npm symlinks, lockfile, removed stale runner COPYs).

^{Reviewed by Cursor Bugbot for commit 3b72bc4. Configure here.}

[lelia]

Added the OSS toolchain refresh to this PR (major point release anyway): TruffleHog → 3.96.0, OpenGrep → v1.26.0, uv → 0.12.1, gosec → v2.28.0, Go → 1.26.5 (app_tests), Socket CLI → 2.5.8 (heavy). Runtime bases (python:3.12, node:22) deliberately not bumped here — those change the shipped runtime rather than the scanner toolchain and should get their own PR. CI smoke/integration runs validate every bump in this set.

[lelia]

Two additions per discussion: (1) integration Test 4 — the trivy connector now runs end-to-end against a fixture Dockerfile (--dockerfiles → trivy config → parsing), with an explicit failure on the connector's "Trivy not found" fallback so a missing binary can't pass silently; (2) Docker Hub secrets scoped to the publish environment — merge-manifests binds the environment directly, build-test-push uses secrets: inherit with the reusable pipeline binding the environment conditionally in push mode only (PR builds bind none, so branch policy isn't violated). PR CI validates the push:false path; the first real publish validates push:true, after which the repo-level DOCKERHUB_* secrets should be deleted.

[lelia]

bugbot run

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3b72bc4. Configure here.}