ci: route trivy findings to jira

[alexpriv8]

Description of change

Align the repository Trivy scanner configuration with the public shared action and enable the maintained license scanner settings.

Validation

• Staged-file pre-commit checks passed.
• No internal Jira references are included.

[deepsource-io]

DeepSource Code Review

We reviewed changes in db4763d...553befd on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Sep 25, 2026 10:33p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[Copilot]

Copilot review overview

🟡 Changes recommended

Restore vulnerability coverage and scope license scanning appropriately.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Restore vulnerability scanning or add the missing scheduled workflow · New
• Avoid enabling license scanning in the local Trivy pre-commit hook · New

What changed in this PR

Updates Trivy configuration to route findings toward Jira by enabling license scanning and disabling vulnerability scanning.

Changes:

• Disables the vuln scanner.
• Enables license scanning settings.

File	Summary
.trivy.yaml	Adjusts Trivy scanners; moderate issues remain regarding lost vulnerability coverage and license scanning affecting local pre-commit runs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.