[appleboy]

Summary

Apply the HIGH/CRITICAL severity filter explicitly in SARIF mode and return a failing status for matching Trivy findings so the existing release dependency blocks publication. Refresh affected locked dependencies, including compatible Python 3.10 variants, and add Actions/uv dependency update PRs. Add a manual scan trigger; the repository Trivy workflow was disabled due to inactivity and has been re-enabled.

Verification

Check out ci/maintenance-checks and run commands from the repository root. Use the repository runtime version files and installed Make/actionlint. Go checks used Go 1.26.10; link checks used Lychee 0.24.2; Python checks used uv with Python 3.10 and 3.12. Install Helm, OpenTofu, Docker or Trivy only where the commands below require them.

Command	Observed result
actionlint .github/workflows/*.yml	Passed; workflow syntax and expressions validated
git diff --check main...HEAD	Passed as staged diff before commit
uv sync --all-extras --python 3.12 && make lint typecheck test	Passed; lint, type checking and 65 tests
uv sync --all-extras --python 3.10 && make lint typecheck test	Passed; lint, type checking and 65 tests
trivy fs --severity CRITICAL,HIGH --exit-code 1 --format sarif --output /tmp/signet-python.sarif .	Passed after lockfile update; original lockfile returned exit 1 with HIGH/CRITICAL findings

Each validation command should return zero. Lint/test failures must stop the job. External link availability can fail independently of source changes; inspect the reported URL rather than ignoring all failures. GitHub job execution is verified after opening this PR. Production publication/deployment is Not run: this PR does not publish releases, push images or apply infrastructure. Dependency update PR scheduling is Not run locally; GitHub enables the configuration after merge.

Security gate inspection Passed: HIGH/CRITICAL findings return exit 1; publication remains downstream of scan success and SARIF uploads remain available where configured. Docker scans retain the existing ignore-unfixed policy. The Python baseline scan actually failed before dependency remediation and passed afterward.

Flow

flowchart TD
  A["trivy.yml: scan locked dependencies"] --> B["trivy.yml: fail on HIGH or CRITICAL"]
  style A fill:#d4edda
  style B fill:#d4edda

Loading

AI authorship and review

• Tool: OpenAI Codex
• AI-authored files: .github/dependabot.yml, .github/workflows/trivy.yml, uv.lock
• Human line-by-line reviewed: None — not yet reviewed by a human.
• Classification: Core; shared CI/release orchestration. Recommend two reviewers including the repository owner.

Scope, risk and rollback

Implements the requested repository maintenance review. No issue identifier was supplied. Review failure propagation, dependency coverage and the changed workflow steps. No secrets or unrelated local changes are included. Stricter checks can intentionally block a future change; investigate findings before release. Revert this commit to roll back.