KB / Memory / tech-trivy-two-phase
Two-phase Trivy scan
Report job always succeeds; separate fail-on-severity job gates the build
Phase 1: scan with exit 0 for artifacts. Phase 2: fail on CRITICAL/HIGH, ideally reusing setup.
Related: tech-pin-github-actions, tech-codebase-maintenance-loop.