feat(ci): reconcile repository CI configurations

.github/workflows/pr-semantic.yaml

@@ -0,0 +1,29 @@
+name: CI - Conventions
+on:
+  pull_request:
+    types: [opened, reopened, edited, labeled, unlabeled, synchronize]
+
+concurrency:
+  group: pr-semantic-check-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  pull-requests: write
+  statuses: write
+  contents: read
+
+jobs:
+  pr_labels:
+    name: Add labels
+    runs-on: ubuntu-latest
+    steps:
+      - uses: srvaroa/labeler@b4493338d7929ddc4ffc95fadf6f28c73bae2e90
+        with:
+          config_path: .github/labeler-config.yaml
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+  semantic_pr:
+    needs: pr_labels
+    name: Semantic
+    uses: dnlopes/Reusable.Workflows/.github/workflows/semantic-pr.yaml@v1

.github/workflows/pr-trivy.yaml

@@ -0,0 +1,12 @@
+name: CI - Trivy
+on:
+  pull_request:
+
+concurrency:
+  group: pr-trivy-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  security:
+    name: Security
+    uses: dnlopes/Reusable.Workflows/.github/workflows/trivy-scan.yaml@v1

.github/workflows/release.yaml

@@ -1,4 +1,4 @@
-name: Release
+name: CI - Release
 on:
   push:
     branches:
@@ -21,18 +21,6 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Semantic Release
-        id: semantic_release
         uses: cycjimmy/semantic-release-action@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Update major/minor tags
-        if: steps.semantic_release.outputs.new_release_published == 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          git tag -f "v${{ steps.semantic_release.outputs.new_release_major_version }}"
-          git tag -f "v${{ steps.semantic_release.outputs.new_release_major_version }}.${{ steps.semantic_release.outputs.new_release_minor_version }}"
-          git push origin -f "v${{ steps.semantic_release.outputs.new_release_major_version }}"
-          git push origin -f "v${{ steps.semantic_release.outputs.new_release_major_version }}.${{ steps.semantic_release.outputs.new_release_minor_version }}"

.trivyignore

@@ -0,0 +1,86 @@
+# Trivy Ignore File
+# Copy this file to your repository root as '.trivyignore'
+# Documentation: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/#by-vulnerability-ids
+#
+# Format:
+#   - One entry per line
+#   - Lines starting with # are comments
+#   - Supports CVE IDs, vulnerability IDs, and package specifiers
+#
+# IMPORTANT: Document WHY each vulnerability is ignored!
+# Review this file regularly and remove entries when fixes are available.
+
+# =============================================================================
+# EXAMPLE: Ignore specific CVEs
+# =============================================================================
+
+# CVE-2023-XXXXX: False positive - not exploitable in our context
+# Affected: example-package v1.2.3
+# Reason: We don't use the vulnerable code path
+# Review date: 2024-01-15
+# CVE-2023-XXXXX
+
+# CVE-2024-YYYYY: No fix available, mitigated by network policy
+# Affected: another-package v4.5.6
+# Reason: Service is not exposed externally, mitigated at network layer
+# Review date: 2024-02-01
+# CVE-2024-YYYYY
+
+# =============================================================================
+# EXAMPLE: Ignore by package (use with caution!)
+# =============================================================================
+
+# Ignore all vulnerabilities in a specific Go package
+# Only use when the package is vendored and patched internally
+# pkg:golang/github.com/example/internal-fork
+
+# =============================================================================
+# EXAMPLE: Ignore vulnerabilities until a specific date
+# =============================================================================
+
+# Format: CVE-ID exp:YYYY-MM-DD
+# The vulnerability will be ignored until the expiration date
+# After expiration, Trivy will report it again
+
+# CVE-2024-ZZZZZ: Temporary ignore while waiting for upstream fix
+# Expected fix in next release (ETA: March 2024)
+# CVE-2024-ZZZZZ exp:2024-03-31
+
+# =============================================================================
+# EXAMPLE: Ignore misconfigurations by ID
+# =============================================================================
+
+# AVD-AWS-0086: S3 bucket logging - handled by centralized logging solution
+# AVD-AWS-0086
+
+# AVD-KSV-0001: Process can elevate privileges - required for init container
+# AVD-KSV-0001
+
+# =============================================================================
+# EXAMPLE: Ignore secrets (use with extreme caution!)
+# =============================================================================
+
+# Only ignore secrets that are:
+# - Test/example values in documentation
+# - Already rotated/invalidated
+# - False positives (e.g., UUIDs detected as secrets)
+
+# generic-api-key: False positive - this is a placeholder in example config
+# examples/config.example.yaml
+
+# =============================================================================
+# COMMON FALSE POSITIVES
+# =============================================================================
+
+# Test fixtures and example files often trigger false positives
+# Consider using skip-dirs in trivy.yaml instead of ignoring here
+
+# =============================================================================
+# YOUR PROJECT-SPECIFIC IGNORES BELOW
+# =============================================================================
+# Remember to:
+# 1. Document the reason for each ignore
+# 2. Set a review/expiration date
+# 3. Remove entries when fixes become available
+# 4. Review this file in security audits
+

renovate.json

@@ -1,29 +1,36 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:best-practices",
-    ":semanticCommitType(chore)",
-    ":semanticCommitScope(deps)",
+    ":automergeMinor",
     ":automergePr",
     ":automergeRequireAllStatusChecks",
     ":combinePatchMinorReleases",
-    ":automergeMinor",
-    ":enableVulnerabilityAlertsWithLabel(vulnerability)",
+    ":configMigration",
+    ":enableVulnerabilityAlerts",
     ":labels(renovate, dependencies)",
     ":rebaseStalePrs",
-    ":timezone(UTC)"
+    ":semanticCommitScope(deps)",
+    ":semanticCommitType(chore)",
+    ":timezone(UTC)",
+    "config:best-practices"
   ],
-  "schedule": ["before 5am every weekend"],
+  "schedule": ["* 0-5 * * 4,5"],
   "reviewersFromCodeOwners": true,
   "automergeStrategy": "squash",
   "packageRules": [
     {
-      "groupName": "All Minor Updates",
+      "matchDepTypes": [
+        "action"
+      ],
+      "pinDigests": false
+    },
+    {
+      "groupName": "all-minor",
       "matchUpdateTypes": ["minor"],
       "automerge": true
     },
     {
-      "groupName": "All Patch Updates",
+      "groupName": "all-patch",
       "matchUpdateTypes": ["patch"],
       "automerge": true
     }

trivy.yaml

@@ -0,0 +1,27 @@
+format: table
+exit-code: 1
+timeout: 10m
+severity: [CRITICAL, HIGH, MEDIUM]
+scanners: [vuln, secret, misconfig]
+
+scan:
+  skip-dirs:
+    - node_modules
+    - vendor
+    - .git
+    - .terraform
+    - __pycache__
+    - .venv
+    - venv
+    - dist
+    - build
+    - .cache
+
+vulnerability:
+  type: [library]
+  ignore-unfixed: true
+
+misconfiguration:
+  include-non-failures: false
+  terraform:
+    exclude-downloaded-modules: true