build(deps): bump github.com/testcontainers/testcontainers-go from 0.43.0 to 0.44.0 #92

	name: Trivy Security Scan

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main
	schedule:
	- cron: "0 0 * * 0"

	permissions:
	contents: read
	security-events: write

	jobs:
	scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@v0.36.0
	with:
	scan-type: fs
	scan-ref: .
	format: sarif
	output: trivy-results.sarif
	# No severity filter on purpose: the Go vuln DB does not assign CVSS
	# scores, so Trivy reports most Go advisories as UNKNOWN. A
	# `severity: CRITICAL,HIGH` filter silently drops all of them (this
	# is how CVE-2026-56852 in golang.org/x/text went unnoticed).
	ignore-unfixed: true

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v4.37.4
	if: always()
	with:
	sarif_file: trivy-results.sarif

Navigation Menu