Replace the per-image catalogs array with a flat structure: results
are now keyed by (catalog, version), with the same image's scan
counts duplicated across every chart/version that references it.
summary now lists only CRITICAL vulnerabilities, formatted as
"CVE-ID: description" pairs joined by "; ". Description comes from
trivy's Title field, falling back to the first sentence of Description.
Allow scanning a single catalog (manifests/helm/<chart>/) via the
workflow_dispatch chart input, filtering images_final.tsv by chart
name before the limit is applied. Empty value scans the full catalog
as before.
Allow scanning a single catalog (manifests/helm/<chart>/) via the
workflow_dispatch chart input, filtering images_final.tsv by chart
name before the limit is applied. Empty value scans the full catalog
as before.
Parallel trivy image workers sharing the fs cache directory hit
"cache may be in use by another process: timeout" errors. Switch to
--cache-backend memory to avoid bolt-db lock contention, matching the
approach already used in generate-sbom.sh.
Python was still reading DOCKERHUB_PAASUP_USER/TOKEN while the env:
block sets DOCKERHUB_USER/TOKEN, silently disabling private registry
auth. Also restore the nvcr.io (NGC) auth entry that was dropped.
Skip SBOM generation entirely since cve-edge-post.yml only needs
vulnerability counts, not CycloneDX artifacts — scan each image with
`trivy image` directly and aggregate with python3 (drop jq dependency).
Output is now a JSON array with one entry per image instead of a single
merged summary.
ychangkim