ci: pin actions to commit SHAs, guard Docker jobs from forks, scan the image, gate publish on security (SEC-06, SEC-07, SEC-14, SEC-15, SEC-16)

scripts/ci/install_trivy.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Install a pinned Trivy release into a directory, verifying its sha256.
+#
+# Usage: scripts/ci/install_trivy.sh <dest-dir>
+#
+# The binary ends up at <dest-dir>/trivy. To upgrade, bump TRIVY_VERSION and both
+# digests from the release's trivy_<version>_checksums.txt.
+set -euo pipefail
+
+TRIVY_VERSION="0.76.0"
+SHA256_X64="e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7"
+SHA256_ARM64="aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c"
+
+dest="${1:?usage: install_trivy.sh <dest-dir>}"
+
+case "$(uname -m)" in
+  x86_64 | amd64)
+    arch="64bit"
+    expected="${SHA256_X64}"
+    ;;
+  aarch64 | arm64)
+    arch="ARM64"
+    expected="${SHA256_ARM64}"
+    ;;
+  *)
+    echo "unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+archive="trivy_${TRIVY_VERSION}_Linux-${arch}.tar.gz"
+url="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
+
+work="$(mktemp -d)"
+trap 'rm -rf "${work}"' EXIT
+
+curl --fail --silent --show-error --location --retry 3 --output "${work}/${archive}" "${url}"
+echo "${expected}  ${work}/${archive}" | sha256sum --check --status || {
+  echo "sha256 mismatch for ${archive}" >&2
+  exit 1
+}
+
+mkdir -p "${dest}"
+tar -xzf "${work}/${archive}" -C "${dest}" trivy
+chmod 0755 "${dest}/trivy"
+"${dest}/trivy" version