ci: triage Zoekt binaries from the Sourcebot image

.github/workflows/vulnerability-triage.yml

@@ -15,4 +15,10 @@ permissions:
 jobs:
   triage:
     uses: sourcebot-dev/sourcebot/.github/workflows/vulnerability-triage.yml@main
+    with:
+      # Zoekt ships inside the Sourcebot image. Scan its binaries there so Go
+      # module CVEs land on this repository (sourcebot-dev/sourcebot-private
+      # excludes the same targets from its own scan).
+      image: ghcr.io/sourcebot-dev/sourcebot
+      trivy_include_targets: '^usr/local/bin/zoekt-'
     secrets: inherit

trivy.yaml

@@ -0,0 +1,17 @@
+# Docs: https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/
+
+scan:
+  scanners:
+    - vuln
+
+  pkg-types:
+    - os
+    - library
+
+severity:
+  - CRITICAL
+  - HIGH
+  - MEDIUM
+
+vulnerability:
+  ignore-unfixed: true