[brendan-kellam]

Summary

Zoekt's Go dependencies only reach users through the Sourcebot image, and that image is scanned by sourcebot-private's Trivy job, so their CVEs have been filed as [sourcebot-dev/sourcebot-private] Linear issues (e.g. SOU-2646 klauspost/compress, SOU-2647/2648/2649/2650/2653 golang.org/x/net). Remediation can't fix them there. Dependabot here doesn't catch them either: the golang.org/x/net advisories (GO-2026-6603/6610/6611/6612/6617) are in the Go vulnerability database but not in the GitHub Advisory Database.

This PR makes this repository's triage scan ghcr.io/sourcebot-dev/sourcebot:main, filtered to the Zoekt binaries (^usr/local/bin/zoekt-). It also adds a trivy.yaml that matches sourcebot-private's: vuln scanner only, os and library packages, MEDIUM and above, unfixed findings ignored. These findings are now part of this repo's own scan results. They get [sourcebot-dev/zoekt] issues, which this repo's CVE remediation picks up. They're auto-closed once the fixed Zoekt ships in the image.

Merge order:

1. fix(ci): add Trivy target filters to vulnerability triage sourcebot#1724 first. It adds the trivy_include_targets input; this workflow calls it from @main and fails with an unknown input until then.
2. This PR and sourcebot-dev/sourcebot-private#132 together. Once sourcebot-private stops filing these issues, its next run closes the old [sourcebot-dev/sourcebot-private] copies.

Test plan

• After merging #1724, run Vulnerability Triage manually and check that the Trivy job scans the image and reports only usr/local/bin/zoekt-* targets
• Check that Linear issues are created as [sourcebot-dev/zoekt] CVE-…. The repo label can't be created right now: the Linear API key lacks write scope, so issues are created without it. Create the sourcebot-dev/zoekt label manually.

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only changes to vulnerability scanning scope and Trivy config; no application runtime or auth behavior changes.

Overview
Routes Zoekt-related CVE triage to this repo by extending the scheduled reusable Vulnerability Triage workflow with inputs that scan ghcr.io/sourcebot-dev/sourcebot and limit Trivy targets to usr/local/bin/zoekt-* binaries, so Go module vulnerabilities in those binaries open [sourcebot-dev/zoekt] issues here instead of on sourcebot-private.

Adds a root trivy.yaml aligned with sourcebot-private: vulnerability scanner only, OS and library packages, MEDIUM and above, and ignore-unfixed enabled.

Depends on sourcebot#1724 for the trivy_include_targets workflow input before this workflow can succeed on @main.

^{Reviewed by Cursor Bugbot for commit 549890e. Bugbot is set up for automated code reviews on this repo. Configure here.}