From 99932dfcbd56b4b2bf98c651e0b25a8d0571f3a2 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 2 Apr 2026 00:32:36 -0700
Subject: [PATCH] ci: expand Trivy scan to cover all Dockerfiles

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/trivy-scan.yml | 66 ++++++++++++++++++++++++++++++--
 1 file changed, 63 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index 27e37b864fe..ba0b99aafdd 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -3,8 +3,9 @@ name: Trivy Dockerfile Scan
 on:
   pull_request:
     paths:
+      - "Dockerfile"
       - "docker/Dockerfile*"
-      - "containers/**/Dockerfile*"
+      - "docker/**/Dockerfile*"
   push:
     branches:
       - main
@@ -27,10 +28,20 @@ jobs:
 
       # Pin trivy-action to the only safe commit after the March 2026 supply chain attack.
       # See: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
-      - name: Run Trivy on Dockerfile.custom_ui
+
+      - name: Run Trivy on Dockerfile (root)
         uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
+          scan-type: config
+          scan-ref: Dockerfile
+          format: table
+          severity: LOW,MEDIUM,HIGH,CRITICAL
+          exit-code: "1"
 
+      - name: Run Trivy on Dockerfile.custom_ui
+        if: always()
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
           scan-type: config
           scan-ref: docker/Dockerfile.custom_ui
           format: table
@@ -41,9 +52,58 @@ jobs:
         if: always()
         uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
-
           scan-type: config
           scan-ref: docker/Dockerfile.health_check
           format: table
           severity: LOW,MEDIUM,HIGH,CRITICAL
           exit-code: "1"
+
+      - name: Run Trivy on Dockerfile.database
+        if: always()
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: config
+          scan-ref: docker/Dockerfile.database
+          format: table
+          severity: LOW,MEDIUM,HIGH,CRITICAL
+          exit-code: "1"
+
+      - name: Run Trivy on Dockerfile.non_root
+        if: always()
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: config
+          scan-ref: docker/Dockerfile.non_root
+          format: table
+          severity: LOW,MEDIUM,HIGH,CRITICAL
+          exit-code: "1"
+
+      - name: Run Trivy on Dockerfile.alpine
+        if: always()
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: config
+          scan-ref: docker/Dockerfile.alpine
+          format: table
+          severity: LOW,MEDIUM,HIGH,CRITICAL
+          exit-code: "1"
+
+      - name: Run Trivy on Dockerfile.dev
+        if: always()
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: config
+          scan-ref: docker/Dockerfile.dev
+          format: table
+          severity: LOW,MEDIUM,HIGH,CRITICAL
+          exit-code: "1"
+
+      - name: Run Trivy on Dockerfile.build_from_pip
+        if: always()
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: config
+          scan-ref: docker/build_from_pip/Dockerfile.build_from_pip
+          format: table
+          severity: LOW,MEDIUM,HIGH,CRITICAL
+          exit-code: "1"