From 21b60420bf5d0f098418dfec4961b41338cd8055 Mon Sep 17 00:00:00 2001
From: Luke Heath <luke@fleetdm.com>
Date: Fri, 8 May 2026 09:25:03 -0500
Subject: [PATCH] Trivy: skip SARIF upload on PR/push, add legacy category
 dismissal (#44987)

---
 .github/workflows/trivy-close-legacy.yml | 14 ++++++++++++--
 .github/workflows/trivy-scan.yml         | 19 +++++++++++--------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/trivy-close-legacy.yml b/.github/workflows/trivy-close-legacy.yml
index e5f69eb9f7..5e671c4d93 100644
--- a/.github/workflows/trivy-close-legacy.yml
+++ b/.github/workflows/trivy-close-legacy.yml
@@ -1,11 +1,21 @@
 name: Close legacy trivy alerts
-on: workflow_dispatch
+on:
+  workflow_dispatch:
+    inputs:
+      categories:
+        description: 'JSON array of categories to dismiss'
+        required: true
+        default: '["trivy-rc-patch-fleet-v4.84.2","trivy-rc-patch-fleet-v4.84.3"]'
 permissions:
   security-events: write
   contents: read
 jobs:
   reset:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        category: ${{ fromJSON(inputs.categories) }}
     steps:
       - run: |
           cat > clean.sarif <<'EOF'
@@ -18,4 +28,4 @@ jobs:
       - uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: clean.sarif
-          category: .github/workflows/trivy-scan.yml:trivy
+          category: ${{ matrix.category }}
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index a6023d3811..4283cd6f18 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -117,18 +117,21 @@ jobs:
         with:
           scan-type: "fs"
           ignore-unfixed: false
-          format: "sarif"
-          output: "trivy-results.sarif"
+          # PR/push: print findings to the run log and fail the check so
+          # engineers see issues before merging. Schedule/manual matrix runs:
+          # emit SARIF for upload to the Security tab.
+          format: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'sarif' || 'table' }}
+          output: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'trivy-results.sarif' || '' }}
+          exit-code: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '0' || '1' }}
           severity: "CRITICAL,HIGH,MEDIUM,LOW"
           trivyignores: "./security/code/.trivyignore"
 
       - name: Upload Trivy scan results to GitHub Security tab
+        # Only upload on schedule/manual runs. PR/push uploads register
+        # instances on `refs/pull/*/merge` refs that are never re-scanned
+        # after the PR closes, leaving zombie alerts open forever.
+        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
         uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6
         with:
           sarif_file: "trivy-results.sarif"
-          # On nightly/manual runs the matrix scans multiple branches, so use a
-          # distinct category per branch to keep results separate. On push/PR
-          # there's only one matrix run, so leave category empty and let
-          # upload-sarif use its default — avoids slashes in github.ref_name
-          # (e.g. "123/merge" on pull_request) leaking into the category.
-          category: ${{ matrix.branch && format('trivy-{0}', matrix.branch) || '' }}
+          category: trivy-${{ matrix.branch }}