[efraespada]

Summary

The container security scan in promotion #69 expired while downloading Trivy's Java vulnerability database, before analysis could finish. Give Trivy a 30-minute budget and the complete container job 60 minutes so the existing isolated caches can download their databases and run the full scan.

Related to #62. Follows #68 and unblocks #69.

Change

• Set the Trivy action's supported timeout input to 30m.
• Raise the container job's overall limit from 45 to 60 minutes to accommodate the candidate image build and cold database bootstrap.
• Keep the per-run cache, scanners, permissions, SARIF upload, Docker isolation, and runner routing in their existing configuration.

The original failure is recorded in Security run 40164041857. The Java DB download alone took 6m32s there. A fresh-cache local reproduction took 22m13s to bootstrap the databases and exceeded an attempted 15-minute scan budget. The database download does not stop immediately when the scan context expires.

Verification

• Workflow YAML parsed successfully; Actionlint and git diff --check passed.
• Trivy 0.76.1 completed the full candidate-image analysis with the final 30-minute setting and generated SARIF. Vulnerability and secret scanners were both enabled. With the measured databases available, analysis completed in 3.2 seconds; the observed cold bootstrap plus analysis fits the final budget.
• The local check used the previously validated backend image for chore(deps): consolidate standalone dependency updates #68, an empty private Docker client configuration, and an owned temporary cache. Application and image inputs are unchanged.
• Current-head CI passed, including backend tests, frontend tests, Android, plugins, lint, security and coverage. Copilot technical review completed with no findings or unresolved conversations. Copilot automatic approval is neutral because workflow changes are outside its configured approval scope; the maintainer explicitly authorized this correction and merge. Promotion chore: promote consolidated dependency updates to master (#62) #69 must be revalidated at its updated develop head before merging into master.

Review notes

This follow-up uses the same existing branch originally published and verified by the Action for #62. The maintainer authorized fixing any CI failure before completing the develop-to-master promotion. This is a bounded execution-time correction for the complete scan.

Reference: the Trivy troubleshooting guide recommends increasing the scan timeout when analysis reaches its deadline; the action exposes a timeout input.

[vypbot]

Bugbot: review complete

Current status: No active findings on 438c872.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: This pull request is outside the configured approval scope.
Completed: 7/7 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 438c872af3e7; base: 4ca3794c3fb7; reason: scope.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.33%. Comparing base (65033dc) to head (438c872).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop      #70   +/-   ##
==========================================
  Coverage      15.33%   15.33%           
  Complexity       192      192           
==========================================
  Files            149      149           
  Lines          16462    16462           
  Branches        2379     2379           
==========================================
  Hits            2525     2525           
  Misses         13834    13834           
  Partials         103      103           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.