ci: route trivy findings to jira

[alexpriv8]

Description of change

Align the repository Trivy scanner configuration with the public shared action and enable the maintained license scanner settings.

Validation

• Staged-file pre-commit checks passed.
• No internal Jira references are included.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 3abac28...8cccf48 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Sep 25, 2026 10:33p.m.	Review ↗
Python		Sep 25, 2026 10:33p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[Copilot]

Copilot review overview

🟡 Changes recommended

Removing vuln globally disables scheduled vulnerability scanning; configure the scheduled job to pass it explicitly.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Removing vuln scanner disables it for scheduled scans · New

What changed in this PR

Updates Trivy configuration to align with the shared action and enable license scanning.

Changes:

• Removes vuln from the scanner list.
• Enables license scanning.

File	Summary
.trivy.yaml	Adjusts enabled Trivy scanners.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.