From 0f6dd0bfa28937833226da4a06122e371e142eec Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 15:10:53 +0530
Subject: [PATCH 01/33] feat: add Trivy security scan workflow for
 vulnerability detection

---
 .github/workflows/security-scan.yml | 213 ++++++++++++++++++++++++++++
 1 file changed, 213 insertions(+)
 create mode 100644 .github/workflows/security-scan.yml

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
new file mode 100644
index 00000000..4d9c5c9c
--- /dev/null
+++ b/.github/workflows/security-scan.yml
@@ -0,0 +1,213 @@
+name: Security Scan
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  security-scan:
+    name: Trivy Security Scan
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+          cache-dependency-path: |
+             go.sum
+
+      - name: Build extension
+        run: make build
+
+      - name: Download Go modules
+        run: go mod download
+
+      - name: Run Trivy vulnerability scanner in table mode
+        # Table output is useful when running on a pull request or push for immediate feedback
+        if: contains(fromJSON('["push", "pull_request"]'), github.event_name)
+        uses: aquasecurity/trivy-action@0.32.0
+        continue-on-error: true
+        id: trivy_table
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          scanners: 'vuln,secret,config'
+          skip-dirs: 'examples'
+
+      - name: Run Trivy for detailed results
+        # Generate JSON for detailed vulnerability information
+        if: contains(fromJSON('["push", "pull_request"]'), github.event_name)
+        uses: aquasecurity/trivy-action@0.32.0
+        continue-on-error: true
+        id: trivy_json
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'json'
+          output: 'trivy-results.json'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          scanners: 'vuln,secret,config'
+          skip-dirs: 'examples'
+
+      - name: Run Trivy vulnerability scanner in SARIF mode
+        # Generate SARIF report for scheduled runs to upload to GitHub Security tab
+        if: ${{ github.event_name == 'schedule' }}
+        uses: aquasecurity/trivy-action@0.32.0
+        continue-on-error: true
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          scanners: 'vuln,secret,config'
+          skip-dirs: 'examples'
+
+      - name: Run Trivy for PR comment
+        # Generate SARIF for PR comments when vulnerabilities are found
+        if: github.event_name == 'pull_request'
+        uses: aquasecurity/trivy-action@0.32.0
+        continue-on-error: true
+        id: trivy_sarif
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          scanners: 'vuln,secret,config'
+          skip-dirs: 'examples'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        # Upload SARIF when running scheduled scans or PR scans
+        if: ${{ github.event_name == 'schedule' || github.event_name == 'pull_request' }}
+        uses: github/codeql-action/upload-sarif@v3
+        continue-on-error: true
+        with:
+          sarif_file: 'trivy-results.sarif'
+
+      - name: Comment on PR with Trivy results
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        continue-on-error: true
+        with:
+          script: |
+            const fs = require('fs');
+            let comment = '## 🔒 Trivy Security Scan Results\n\n';
+            
+            // Check Trivy results based on step outcome
+            const trivyTableResult = '${{ steps.trivy_table.outcome }}';
+            const trivyJsonResult = '${{ steps.trivy_json.outcome }}';
+            const trivySarifResult = '${{ steps.trivy_sarif.outcome }}';
+            
+            console.log('Trivy step outcomes:', { trivyTableResult, trivyJsonResult, trivySarifResult });
+            
+            if (trivyTableResult === 'failure' || trivyJsonResult === 'failure' || trivySarifResult === 'failure') {
+              comment += '⚠️ **Trivy Security Scanner detected vulnerabilities**\n\n';
+              
+              // Try to read detailed results from JSON output
+              try {
+                if (fs.existsSync('trivy-results.json')) {
+                  const jsonData = fs.readFileSync('trivy-results.json', 'utf8');
+                  console.log('Trivy JSON data length:', jsonData.length);
+                  const results = JSON.parse(jsonData);
+                  
+                  if (results.Results && results.Results.length > 0) {
+                    comment += '### 📋 Detailed Findings:\n\n';
+                    let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
+                    
+                    results.Results.forEach(result => {
+                      if (result.Vulnerabilities && result.Vulnerabilities.length > 0) {
+                        comment += `**📁 File/Package: \`${result.Target}\`**\n\n`;
+                        comment += '| CVE | Severity | Package | Installed | Fixed | Title |\n';
+                        comment += '|-----|----------|---------|-----------|-------|-------|\n';
+                        
+                        result.Vulnerabilities.slice(0, 10).forEach(vuln => {
+                          const severity = vuln.Severity || 'UNKNOWN';
+                          const cve = vuln.VulnerabilityID || 'N/A';
+                          const pkg = vuln.PkgName || 'N/A';
+                          const installed = vuln.InstalledVersion || 'N/A';
+                          const fixed = vuln.FixedVersion || 'Not Fixed';
+                          const title = (vuln.Title || '').substring(0, 50) + (vuln.Title && vuln.Title.length > 50 ? '...' : '');
+                          
+                          // Count by severity
+                          switch(severity) {
+                            case 'CRITICAL': criticalCount++; break;
+                            case 'HIGH': highCount++; break;
+                            case 'MEDIUM': mediumCount++; break;
+                            case 'LOW': lowCount++; break;
+                          }
+                          
+                          const severityEmoji = severity === 'CRITICAL' ? '🔴' : 
+                                               severity === 'HIGH' ? '🟠' : 
+                                               severity === 'MEDIUM' ? '🟡' : '🔵';
+                          
+                          comment += `| ${cve} | ${severityEmoji} ${severity} | ${pkg} | ${installed} | ${fixed} | ${title} |\n`;
+                        });
+                        
+                        if (result.Vulnerabilities.length > 10) {
+                          comment += `\n*... and ${result.Vulnerabilities.length - 10} more vulnerabilities*\n`;
+                        }
+                        comment += '\n';
+                      }
+                    });
+                    
+                    comment += `### 📊 Summary:\n`;
+                    if (criticalCount > 0) comment += `- 🔴 **Critical**: ${criticalCount}\n`;
+                    if (highCount > 0) comment += `- 🟠 **High**: ${highCount}\n`;
+                    if (mediumCount > 0) comment += `- 🟡 **Medium**: ${mediumCount}\n`;
+                    if (lowCount > 0) comment += `- 🔵 **Low**: ${lowCount}\n`;
+                    comment += '\n';
+                  } else {
+                    comment += '*No vulnerabilities found in detailed results.*\n\n';
+                  }
+                } else {
+                  comment += '*trivy-results.json file not found.*\n\n';
+                  console.log('Trivy JSON file does not exist');
+                }
+              } catch (error) {
+                comment += `*Could not parse detailed results: ${error.message}*\n\n`;
+                console.log('Error parsing Trivy JSON:', error.message);
+              }
+              
+              comment += '❌ **Trivy scan failed** - Please address the vulnerabilities found above.\n\n';
+              comment += 'Please check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for complete details.\n\n';
+            } else {
+              comment += '✅ **Trivy Security Scanner**: No vulnerabilities detected\n\n';
+              comment += '✅ **Trivy scan passed**\n\n';
+            }
+            
+            comment += 'View the complete security scan logs in the [Actions tab](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}).';
+            
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment
+            });
+
+      - name: Fail workflow if Trivy vulnerabilities found
+        if: ${{ (github.event_name == 'pull_request' || github.event_name == 'push') && (steps.trivy_table.outcome == 'failure' || steps.trivy_json.outcome == 'failure' || steps.trivy_sarif.outcome == 'failure') }}
+        run: |
+          echo "❌ Trivy detected security vulnerabilities!"
+          echo "Please review the security scan results above and address the vulnerabilities."
+          exit 1

From 126f9b6d74e817d92a0a1e775d418f9a58abd026 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 16:30:37 +0530
Subject: [PATCH 02/33] chore: Update security-scan.yml

---
 .github/workflows/security-scan.yml | 208 ++++++++--------------------
 1 file changed, 54 insertions(+), 154 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 4d9c5c9c..b17a1f39 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -4,17 +4,24 @@ on:
   push:
     branches:
       - main
+      - dev
   pull_request:
+    branches:
+      - main
+      - dev
 
 jobs:
   security-scan:
     name: Trivy Security Scan
     runs-on: ubuntu-latest
     permissions:
+      # Required for uploading SARIF results
       security-events: write
+      # Required for checking out the code
       contents: read
-      issues: write
+      # Required for posting PR comments
       pull-requests: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -24,7 +31,7 @@ jobs:
         with:
           go-version: '1.23'
           cache-dependency-path: |
-             go.sum
+            go.sum
 
       - name: Build extension
         run: make build
@@ -32,182 +39,75 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
-      - name: Run Trivy vulnerability scanner in table mode
-        # Table output is useful when running on a pull request or push for immediate feedback
-        if: contains(fromJSON('["push", "pull_request"]'), github.event_name)
-        uses: aquasecurity/trivy-action@0.32.0
-        continue-on-error: true
-        id: trivy_table
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'table'
-          exit-code: '1'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln,secret,config'
-          skip-dirs: 'examples'
-
-      - name: Run Trivy for detailed results
-        # Generate JSON for detailed vulnerability information
-        if: contains(fromJSON('["push", "pull_request"]'), github.event_name)
+      - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.32.0
-        continue-on-error: true
-        id: trivy_json
+        id: trivy_scan
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          format: 'json'
-          output: 'trivy-results.json'
-          exit-code: '1'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln,secret,config'
-          skip-dirs: 'examples'
-
-      - name: Run Trivy vulnerability scanner in SARIF mode
-        # Generate SARIF report for scheduled runs to upload to GitHub Security tab
-        if: ${{ github.event_name == 'schedule' }}
-        uses: aquasecurity/trivy-action@0.32.0
-        continue-on-error: true
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln,secret,config'
-          skip-dirs: 'examples'
-
-      - name: Run Trivy for PR comment
-        # Generate SARIF for PR comments when vulnerabilities are found
-        if: github.event_name == 'pull_request'
-        uses: aquasecurity/trivy-action@0.32.0
-        continue-on-error: true
-        id: trivy_sarif
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
+          # Generate multiple report formats
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
           output: 'trivy-results.sarif'
+          # Also generate a table for easy viewing in logs and PR comments
+          list-all-pkgs: true
+          # Fail the build if vulnerabilities are found (exit-code: 1)
+          # We use continue-on-error to allow subsequent steps to run.
           exit-code: '1'
+          # Ignore vulnerabilities that don't have a fix yet
           ignore-unfixed: true
+          # Define the severities to scan for
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          # Define which scanners to use
           scanners: 'vuln,secret,config'
+          # Directories to skip
           skip-dirs: 'examples'
+        # Allow the workflow to continue even if Trivy finds issues,
+        # so we can perform actions like uploading results and commenting on PRs.
+        continue-on-error: true
 
-      - name: Upload Trivy scan results to GitHub Security tab
-        # Upload SARIF when running scheduled scans or PR scans
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'pull_request' }}
+      - name: Upload Trivy SARIF report to GitHub Security tab
+        # Upload the SARIF file to the GitHub Security tab
+        # This runs for pushes to main, pull requests, and scheduled runs.
+        if: always() # Run this step even if the previous one failed
         uses: github/codeql-action/upload-sarif@v3
-        continue-on-error: true
         with:
           sarif_file: 'trivy-results.sarif'
 
       - name: Comment on PR with Trivy results
-        if: github.event_name == 'pull_request'
+        # This step only runs for pull request events.
+        if: ${{ github.event_name == 'pull_request' && steps.trivy_scan.outcome == 'failure' }}
         uses: actions/github-script@v7
-        continue-on-error: true
         with:
           script: |
-            const fs = require('fs');
-            let comment = '## 🔒 Trivy Security Scan Results\n\n';
-            
-            // Check Trivy results based on step outcome
-            const trivyTableResult = '${{ steps.trivy_table.outcome }}';
-            const trivyJsonResult = '${{ steps.trivy_json.outcome }}';
-            const trivySarifResult = '${{ steps.trivy_sarif.outcome }}';
-            
-            console.log('Trivy step outcomes:', { trivyTableResult, trivyJsonResult, trivySarifResult });
-            
-            if (trivyTableResult === 'failure' || trivyJsonResult === 'failure' || trivySarifResult === 'failure') {
-              comment += '⚠️ **Trivy Security Scanner detected vulnerabilities**\n\n';
-              
-              // Try to read detailed results from JSON output
-              try {
-                if (fs.existsSync('trivy-results.json')) {
-                  const jsonData = fs.readFileSync('trivy-results.json', 'utf8');
-                  console.log('Trivy JSON data length:', jsonData.length);
-                  const results = JSON.parse(jsonData);
-                  
-                  if (results.Results && results.Results.length > 0) {
-                    comment += '### 📋 Detailed Findings:\n\n';
-                    let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
-                    
-                    results.Results.forEach(result => {
-                      if (result.Vulnerabilities && result.Vulnerabilities.length > 0) {
-                        comment += `**📁 File/Package: \`${result.Target}\`**\n\n`;
-                        comment += '| CVE | Severity | Package | Installed | Fixed | Title |\n';
-                        comment += '|-----|----------|---------|-----------|-------|-------|\n';
-                        
-                        result.Vulnerabilities.slice(0, 10).forEach(vuln => {
-                          const severity = vuln.Severity || 'UNKNOWN';
-                          const cve = vuln.VulnerabilityID || 'N/A';
-                          const pkg = vuln.PkgName || 'N/A';
-                          const installed = vuln.InstalledVersion || 'N/A';
-                          const fixed = vuln.FixedVersion || 'Not Fixed';
-                          const title = (vuln.Title || '').substring(0, 50) + (vuln.Title && vuln.Title.length > 50 ? '...' : '');
-                          
-                          // Count by severity
-                          switch(severity) {
-                            case 'CRITICAL': criticalCount++; break;
-                            case 'HIGH': highCount++; break;
-                            case 'MEDIUM': mediumCount++; break;
-                            case 'LOW': lowCount++; break;
-                          }
-                          
-                          const severityEmoji = severity === 'CRITICAL' ? '🔴' : 
-                                               severity === 'HIGH' ? '🟠' : 
-                                               severity === 'MEDIUM' ? '🟡' : '🔵';
-                          
-                          comment += `| ${cve} | ${severityEmoji} ${severity} | ${pkg} | ${installed} | ${fixed} | ${title} |\n`;
-                        });
-                        
-                        if (result.Vulnerabilities.length > 10) {
-                          comment += `\n*... and ${result.Vulnerabilities.length - 10} more vulnerabilities*\n`;
-                        }
-                        comment += '\n';
-                      }
-                    });
-                    
-                    comment += `### 📊 Summary:\n`;
-                    if (criticalCount > 0) comment += `- 🔴 **Critical**: ${criticalCount}\n`;
-                    if (highCount > 0) comment += `- 🟠 **High**: ${highCount}\n`;
-                    if (mediumCount > 0) comment += `- 🟡 **Medium**: ${mediumCount}\n`;
-                    if (lowCount > 0) comment += `- 🔵 **Low**: ${lowCount}\n`;
-                    comment += '\n';
-                  } else {
-                    comment += '*No vulnerabilities found in detailed results.*\n\n';
-                  }
-                } else {
-                  comment += '*trivy-results.json file not found.*\n\n';
-                  console.log('Trivy JSON file does not exist');
-                }
-              } catch (error) {
-                comment += `*Could not parse detailed results: ${error.message}*\n\n`;
-                console.log('Error parsing Trivy JSON:', error.message);
-              }
-              
-              comment += '❌ **Trivy scan failed** - Please address the vulnerabilities found above.\n\n';
-              comment += 'Please check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for complete details.\n\n';
-            } else {
-              comment += '✅ **Trivy Security Scanner**: No vulnerabilities detected\n\n';
-              comment += '✅ **Trivy scan passed**\n\n';
-            }
-            
-            comment += 'View the complete security scan logs in the [Actions tab](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}).';
-            
+            const { readFileSync } = require('fs');
+            const results = readFileSync('trivy-results.sarif', 'utf8');
+            const commentBody = `## 🔒 Trivy Security Scan Results
+
+            ⚠️ **Vulnerabilities have been detected in this pull request.**
+
+            Please review the findings in the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for more details.
+
+            <details>
+            <summary>Click to view Trivy Scan Summary</summary>
+
+            \`\`\`json
+            ${results}
+            \`\`\`
+
+            </details>
+            `;
             github.rest.issues.createComment({
-              issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: comment
+              issue_number: context.issue.number,
+              body: commentBody
             });
 
-      - name: Fail workflow if Trivy vulnerabilities found
-        if: ${{ (github.event_name == 'pull_request' || github.event_name == 'push') && (steps.trivy_table.outcome == 'failure' || steps.trivy_json.outcome == 'failure' || steps.trivy_sarif.outcome == 'failure') }}
+      - name: Fail workflow if vulnerabilities were found
+        # This is the final step that will fail the check if the Trivy scan failed.
+        if: ${{ steps.trivy_scan.outcome == 'failure' }}
         run: |
           echo "❌ Trivy detected security vulnerabilities!"
-          echo "Please review the security scan results above and address the vulnerabilities."
+          echo "Please review the scan results and address the issues."
           exit 1

From ccce8a5656f9f3f74f3e609e130071b1e16c7cbf Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 16:59:50 +0530
Subject: [PATCH 03/33] feat: Update security-scan.yml

---
 .github/workflows/security-scan.yml | 70 ++++++++++++++++-------------
 1 file changed, 40 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index b17a1f39..61539011 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -4,11 +4,12 @@ on:
   push:
     branches:
       - main
-      - dev
   pull_request:
     branches:
       - main
-      - dev
+  schedule:
+    # Run every day at midnight UTC
+    - cron: '0 0 * * *'
 
 jobs:
   security-scan:
@@ -39,60 +40,69 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
-      - name: Run Trivy vulnerability scanner
+      - name: Run Trivy for SARIF report
+        # This scan generates the SARIF report for the GitHub Security tab.
+        # It's the primary scan that determines if the workflow should fail.
         uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_scan
+        id: trivy_sarif_scan
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          # Generate multiple report formats
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
           output: 'trivy-results.sarif'
-          # Also generate a table for easy viewing in logs and PR comments
-          list-all-pkgs: true
-          # Fail the build if vulnerabilities are found (exit-code: 1)
-          # We use continue-on-error to allow subsequent steps to run.
+          # Use 'comprehensive' to include vulnerabilities from the Go standard library.
+          detection-priority: 'comprehensive'
           exit-code: '1'
-          # Ignore vulnerabilities that don't have a fix yet
           ignore-unfixed: true
-          # Define the severities to scan for
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          # Define which scanners to use
           scanners: 'vuln,secret,config'
-          # Directories to skip
           skip-dirs: 'examples'
-        # Allow the workflow to continue even if Trivy finds issues,
-        # so we can perform actions like uploading results and commenting on PRs.
+        # Allow the workflow to continue so we can upload results and post comments.
         continue-on-error: true
 
+      - name: Run Trivy for PR comment
+        # This scan runs only on PRs to generate a clean summary table for the comment.
+        if: github.event_name == 'pull_request'
+        uses: aquasecurity/trivy-action@0.32.0
+        id: trivy_comment_scan
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'table'
+          # Use 'comprehensive' to include vulnerabilities from the Go standard library.
+          detection-priority: 'comprehensive'
+          # Set exit-code to 0 so this step doesn't fail the job, it's just for reporting.
+          exit-code: '0'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          scanners: 'vuln,secret,config'
+          skip-dirs: 'examples'
+
       - name: Upload Trivy SARIF report to GitHub Security tab
-        # Upload the SARIF file to the GitHub Security tab
-        # This runs for pushes to main, pull requests, and scheduled runs.
-        if: always() # Run this step even if the previous one failed
+        # Upload the SARIF file. This runs for all event types.
+        if: always() # Run this step even if the primary scan failed
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'trivy-results.sarif'
 
       - name: Comment on PR with Trivy results
-        # This step only runs for pull request events.
-        if: ${{ github.event_name == 'pull_request' && steps.trivy_scan.outcome == 'failure' }}
+        # This step only runs for pull request events if the main scan found issues.
+        if: ${{ github.event_name == 'pull_request' && steps.trivy_sarif_scan.outcome == 'failure' }}
         uses: actions/github-script@v7
         with:
           script: |
-            const { readFileSync } = require('fs');
-            const results = readFileSync('trivy-results.sarif', 'utf8');
+            const table = `${{ steps.trivy_comment_scan.outputs.stdout }}`;
             const commentBody = `## 🔒 Trivy Security Scan Results
 
             ⚠️ **Vulnerabilities have been detected in this pull request.**
 
-            Please review the findings in the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for more details.
+            Please review the summary below and check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for full details.
 
             <details>
-            <summary>Click to view Trivy Scan Summary</summary>
+            <summary>Click to view Vulnerability Summary Table</summary>
 
-            \`\`\`json
-            ${results}
+            \`\`\`
+            ${table}
             \`\`\`
 
             </details>
@@ -105,8 +115,8 @@ jobs:
             });
 
       - name: Fail workflow if vulnerabilities were found
-        # This is the final step that will fail the check if the Trivy scan failed.
-        if: ${{ steps.trivy_scan.outcome == 'failure' }}
+        # This is the final step that will fail the check if the main SARIF scan failed.
+        if: ${{ steps.trivy_sarif_scan.outcome == 'failure' }}
         run: |
           echo "❌ Trivy detected security vulnerabilities!"
           echo "Please review the scan results and address the issues."

From 90006594c10d66f749bdb030102eb78d9780a657 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 17:04:52 +0530
Subject: [PATCH 04/33] feat: Update security-scan.yml

---
 .github/workflows/security-scan.yml | 31 ++++++++---------------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 61539011..54095426 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -7,10 +7,7 @@ on:
   pull_request:
     branches:
       - main
-  schedule:
-    # Run every day at midnight UTC
-    - cron: '0 0 * * *'
-
+      
 jobs:
   security-scan:
     name: Trivy Security Scan
@@ -34,59 +31,47 @@ jobs:
           cache-dependency-path: |
             go.sum
 
-      - name: Build extension
-        run: make build
-
       - name: Download Go modules
         run: go mod download
 
+      - name: Build extension
+        run: make build
+        
       - name: Run Trivy for SARIF report
-        # This scan generates the SARIF report for the GitHub Security tab.
-        # It's the primary scan that determines if the workflow should fail.
         uses: aquasecurity/trivy-action@0.32.0
         id: trivy_sarif_scan
         with:
           scan-type: 'fs'
-          scan-ref: '.'
+          scan-ref: './extension'
           format: 'sarif'
           output: 'trivy-results.sarif'
-          # Use 'comprehensive' to include vulnerabilities from the Go standard library.
-          detection-priority: 'comprehensive'
           exit-code: '1'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
           scanners: 'vuln,secret,config'
-          skip-dirs: 'examples'
-        # Allow the workflow to continue so we can upload results and post comments.
         continue-on-error: true
 
       - name: Run Trivy for PR comment
-        # This scan runs only on PRs to generate a clean summary table for the comment.
         if: github.event_name == 'pull_request'
         uses: aquasecurity/trivy-action@0.32.0
         id: trivy_comment_scan
         with:
           scan-type: 'fs'
-          scan-ref: '.'
+          scan-ref: './extension'
           format: 'table'
-          # Use 'comprehensive' to include vulnerabilities from the Go standard library.
-          detection-priority: 'comprehensive'
-          # Set exit-code to 0 so this step doesn't fail the job, it's just for reporting.
           exit-code: '0'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
           scanners: 'vuln,secret,config'
-          skip-dirs: 'examples'
 
       - name: Upload Trivy SARIF report to GitHub Security tab
-        # Upload the SARIF file. This runs for all event types.
-        if: always() # Run this step even if the primary scan failed
+        
+        if: always() 
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'trivy-results.sarif'
 
       - name: Comment on PR with Trivy results
-        # This step only runs for pull request events if the main scan found issues.
         if: ${{ github.event_name == 'pull_request' && steps.trivy_sarif_scan.outcome == 'failure' }}
         uses: actions/github-script@v7
         with:

From 849cc4422a20ede651bfd3d3abbf1a6d569237d7 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 17:10:15 +0530
Subject: [PATCH 05/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 54095426..980d19e1 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -42,7 +42,7 @@ jobs:
         id: trivy_sarif_scan
         with:
           scan-type: 'fs'
-          scan-ref: './extension'
+          scan-ref: './extensions/newrelic-lambda-extension'
           format: 'sarif'
           output: 'trivy-results.sarif'
           exit-code: '1'
@@ -57,7 +57,7 @@ jobs:
         id: trivy_comment_scan
         with:
           scan-type: 'fs'
-          scan-ref: './extension'
+          scan-ref: './extensions/newrelic-lambda-extension'
           format: 'table'
           exit-code: '0'
           ignore-unfixed: true

From dc02d581d0945531b19d22c726752969e6386743 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 17:30:08 +0530
Subject: [PATCH 06/33] chore: testing workflow

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index a5928639..38dd5906 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/newrelic/newrelic-lambda-extension
 
-go 1.23.10
+go 1.23.8
 
 // Go experimental release X25519Kyber768Draft00 is causing issue with AWS Network Firewall
 godebug tlskyber=0

From c9265cee56c1c02d39e4db95fc5f70dc848b325d Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 17:45:05 +0530
Subject: [PATCH 07/33] chore: update docker and security scan to use this
 docker

---
 .github/workflows/security-scan.yml | 186 +++++++++++++++++++---------
 Dockerfile                          |  29 +++++
 2 files changed, 154 insertions(+), 61 deletions(-)
 create mode 100644 Dockerfile

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 980d19e1..6c65a424 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -7,102 +7,166 @@ on:
   pull_request:
     branches:
       - main
-      
-jobs:
-  security-scan:
-    name: Trivy Security Scan
-    runs-on: ubuntu-latest
-    permissions:
-      # Required for uploading SARIF results
-      security-events: write
-      # Required for checking out the code
-      contents: read
-      # Required for posting PR comments
-      pull-requests: write
 
+jobs:
+  scan:
+    name: Scan ${{ matrix.arch }}
+    runs-on: ubuntu-24.04
+    strategy:
+      # Run both architectures even if one fails so you get a complete report
+      fail-fast: false
+      matrix:
+        arch: [amd64, arm64]
+    
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Setup Go
-        uses: actions/setup-go@v5
+      - name: Set up QEMU
+        # Required to build the non-native architecture (arm64 on an amd64 runner)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
         with:
-          go-version: '1.23'
-          cache-dependency-path: |
-            go.sum
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
 
-      - name: Download Go modules
-        run: go mod download
+      - name: Build Docker image for ${{ matrix.arch }}
+        # This action builds the image and enables caching for faster runs
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/${{ matrix.arch }}
+          tags: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
+          # Load the image into the local Docker daemon so Trivy can scan it
+          load: true
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
 
-      - name: Build extension
-        run: make build
-        
-      - name: Run Trivy for SARIF report
+      # This is a workaround to preserve the cache
+      - name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
+      - name: Run Trivy Scan
         uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_sarif_scan
+        id: trivy_scan
         with:
-          scan-type: 'fs'
-          scan-ref: './extensions/newrelic-lambda-extension'
+          scan-type: 'image'
+          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'sarif'
-          output: 'trivy-results.sarif'
+          output: 'trivy-results-${{ matrix.arch }}.sarif'
           exit-code: '1'
           ignore-unfixed: true
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln,secret,config'
+          severity: 'CRITICAL,HIGH'
+          scanners: 'vuln'
         continue-on-error: true
 
-      - name: Run Trivy for PR comment
-        if: github.event_name == 'pull_request'
+      - name: Generate Trivy table for comments
+        if: ${{ steps.trivy_scan.outcome == 'failure' }}
         uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_comment_scan
         with:
-          scan-type: 'fs'
-          scan-ref: './extensions/newrelic-lambda-extension'
+          scan-type: 'image'
+          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'table'
+          output: 'trivy-table-${{ matrix.arch }}.txt'
           exit-code: '0'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln,secret,config'
+          scanners: 'vuln'
 
-      - name: Upload Trivy SARIF report to GitHub Security tab
-        
-        if: always() 
-        uses: github/codeql-action/upload-sarif@v3
+      - name: Upload Scan Artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          sarif_file: 'trivy-results.sarif'
+          name: scan-artifacts-${{ matrix.arch }}
+          path: |
+            trivy-results-${{ matrix.arch }}.sarif
+            trivy-table-${{ matrix.arch }}.txt
+          if-no-files-found: ignore
 
-      - name: Comment on PR with Trivy results
-        if: ${{ github.event_name == 'pull_request' && steps.trivy_sarif_scan.outcome == 'failure' }}
-        uses: actions/github-script@v7
+  summarize:
+    name: Summarize and Report
+    runs-on: ubuntu-24.04
+    needs: [scan]
+    if: always()
+
+    permissions:
+      security-events: write
+      pull-requests: write
+      contents: read
+
+    steps:
+      - name: Download all scan artifacts
+        uses: actions/download-artifact@v4
         with:
-          script: |
-            const table = `${{ steps.trivy_comment_scan.outputs.stdout }}`;
-            const commentBody = `## 🔒 Trivy Security Scan Results
+          path: artifacts
+
+      - name: Prepare comment
+        id: prep_comment
+        run: |
+          AMD64_TABLE="artifacts/scan-artifacts-amd64/trivy-table-amd64.txt"
+          ARM64_TABLE="artifacts/scan-artifacts-arm64/trivy-table-arm64.txt"
+          COMMENT_BODY="## 🔒 Trivy Security Scan Results\n\n"
+          VULNS_FOUND=false
 
-            ⚠️ **Vulnerabilities have been detected in this pull request.**
+          if [ -f "$AMD64_TABLE" ]; then
+            VULNS_FOUND=true
+            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in x86_64 (amd64) Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $AMD64_TABLE)\n\`\`\`\n\n</details>\n\n"
+          else
+            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in x86_64 (amd64) Image\n"
+          fi
 
-            Please review the summary below and check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for full details.
+          if [ -f "$ARM64_TABLE" ]; then
+            VULNS_FOUND=true
+            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in arm64 Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $ARM64_TABLE)\n\`\`\`\n\n</details>\n\n"
+          else
+            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in arm64 Image\n"
+          fi
 
-            <details>
-            <summary>Click to view Vulnerability Summary Table</summary>
+          if [ "$VULNS_FOUND" = true ]; then
+            COMMENT_BODY="${COMMENT_BODY}\nPlease review the findings and check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for full details."
+          else
+            COMMENT_BODY="## 🔒 Trivy Security Scan Results\n\n✅ All scans passed. No vulnerabilities found in amd64 or arm64 images."
+          fi
+          
+          echo "comment_body<<EOF" >> $GITHUB_OUTPUT
+          echo "$COMMENT_BODY" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
 
-            \`\`\`
-            ${table}
-            \`\`\`
+      - name: Upload all SARIF reports to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: artifacts
 
-            </details>
-            `;
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const body = `${{ steps.prep_comment.outputs.comment_body }}`;
             github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.issue.number,
-              body: commentBody
+              body: body
             });
 
-      - name: Fail workflow if vulnerabilities were found
-        # This is the final step that will fail the check if the main SARIF scan failed.
-        if: ${{ steps.trivy_sarif_scan.outcome == 'failure' }}
+      - name: Clean up Docker images
+        if: always()
+        run: |
+          echo "Cleaning up Docker images..."
+          docker image prune -a -f || true
+
+      - name: Check scan results and fail workflow if needed
+        if: ${{ needs.scan.result == 'failure' }}
         run: |
-          echo "❌ Trivy detected security vulnerabilities!"
-          echo "Please review the scan results and address the issues."
+          echo "❌ One or more security scans failed."
           exit 1
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..8ec04c02
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,29 @@
+FROM golang:1.23-alpine AS builder
+
+ARG TARGETARCH
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . .
+
+RUN if [ "${TARGETARCH}" = "amd64" ]; then \
+      make dist-x86_64; \
+    elif [ "${TARGETARCH}" = "arm64" ]; then \
+      make dist-arm64; \
+    else \
+      echo "Unsupported architecture: ${TARGETARCH}" && exit 1; \
+    fi
+
+FROM alpine:3.20
+
+# It's good practice to add ca-certificates for any potential HTTPS communication.
+RUN apk add --no-cache ca-certificates
+
+WORKDIR /opt
+
+COPY --from=builder /app/extensions .
+

From 7597a57002d88735e16a7000b4e783fc792b64a1 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 17:53:53 +0530
Subject: [PATCH 08/33] chore: updated docker file

---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 8ec04c02..f4ac1158 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,8 @@ FROM golang:1.23-alpine AS builder
 
 ARG TARGETARCH
 
+RUN apk add --no-cache make git
+
 WORKDIR /app
 
 COPY go.mod go.sum ./

From 6134d0b8e36fecad3773b38baf3451faeeb49c46 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 18:01:12 +0530
Subject: [PATCH 09/33] chore: updated code

---
 Dockerfile | 4 ++--
 Makefile   | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f4ac1158..cdcef02d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,9 +13,9 @@ RUN go mod download
 COPY . .
 
 RUN if [ "${TARGETARCH}" = "amd64" ]; then \
-      make dist-x86_64; \
+      make build-for-scan-x86_64; \
     elif [ "${TARGETARCH}" = "arm64" ]; then \
-      make dist-arm64; \
+      make build-for-scan-arm64; \
     else \
       echo "Unsupported architecture: ${TARGETARCH}" && exit 1; \
     fi
diff --git a/Makefile b/Makefile
index bea1625f..0554ea67 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,14 @@ clean:
 	rm -f /tmp/newrelic-lambda-extension.x86_64.zip
 	rm -f /tmp/newrelic-lambda-extension.arm64.zip
 
+# New target for building x86_64 without stripping for security scans
+build-for-scan-x86_64: clean
+	env GOARCH=amd64 GOOS=linux CGO_ENABLED=0 go build -o ./extensions/newrelic-lambda-extension
+
+# New target for building arm64 without stripping for security scans
+build-for-scan-arm64: clean
+	env GOARCH=arm64 GOOS=linux CGO_ENABLED=0 go build -o ./extensions/newrelic-lambda-extension
+
 dist-x86_64: clean
 	env GOARCH=amd64 GOOS=linux CGO_ENABLED=0 go build -ldflags="-s -w" -o ./extensions/newrelic-lambda-extension
 	touch preview-extensions-ggqizro707

From cb9823c4163332f78ce6e2cdbe32036bbca94997 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 18:18:02 +0530
Subject: [PATCH 10/33] chore : updated dependency-tree check

---
 .github/workflows/security-scan.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 6c65a424..348d2ce9 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -13,7 +13,6 @@ jobs:
     name: Scan ${{ matrix.arch }}
     runs-on: ubuntu-24.04
     strategy:
-      # Run both architectures even if one fails so you get a complete report
       fail-fast: false
       matrix:
         arch: [amd64, arm64]
@@ -38,18 +37,15 @@ jobs:
             ${{ runner.os }}-buildx-
 
       - name: Build Docker image for ${{ matrix.arch }}
-        # This action builds the image and enables caching for faster runs
         uses: docker/build-push-action@v5
         with:
           context: .
           platforms: linux/${{ matrix.arch }}
           tags: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
-          # Load the image into the local Docker daemon so Trivy can scan it
           load: true
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
 
-      # This is a workaround to preserve the cache
       - name: Move cache
         run: |
           rm -rf /tmp/.buildx-cache
@@ -76,6 +72,7 @@ jobs:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'table'
+          dependency-tree: true
           output: 'trivy-table-${{ matrix.arch }}.txt'
           exit-code: '0'
           ignore-unfixed: true

From 6a0720ba9ed8f08f419e340e86ce70583a6bb663 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 18:24:09 +0530
Subject: [PATCH 11/33] chore : updating mod

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 38dd5906..5cbd1947 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/newrelic/newrelic-lambda-extension
 
-go 1.23.8
+go 1.23.7
 
 // Go experimental release X25519Kyber768Draft00 is causing issue with AWS Network Firewall
 godebug tlskyber=0

From 452eeb5cf4931a24d8a81041ec7a47b2de66c4ab Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 18:55:48 +0530
Subject: [PATCH 12/33] chore: updated docker

---
 Dockerfile | 2 --
 1 file changed, 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index cdcef02d..330c8579 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,6 @@ RUN if [ "${TARGETARCH}" = "amd64" ]; then \
       echo "Unsupported architecture: ${TARGETARCH}" && exit 1; \
     fi
 
-FROM alpine:3.20
 
 # It's good practice to add ca-certificates for any potential HTTPS communication.
 RUN apk add --no-cache ca-certificates
@@ -28,4 +27,3 @@ RUN apk add --no-cache ca-certificates
 WORKDIR /opt
 
 COPY --from=builder /app/extensions .
-

From 01b5284e61ef68f8919f1783724ce83a0c8d9259 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 18:56:44 +0530
Subject: [PATCH 13/33] chore: updated docker

---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index 330c8579..dc769e87 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,6 +20,7 @@ RUN if [ "${TARGETARCH}" = "amd64" ]; then \
       echo "Unsupported architecture: ${TARGETARCH}" && exit 1; \
     fi
 
+FROM alpine:3.20
 
 # It's good practice to add ca-certificates for any potential HTTPS communication.
 RUN apk add --no-cache ca-certificates

From 869b4f6661bb2dc9f421d47b9cf04ab2582c1ce5 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 18:59:10 +0530
Subject: [PATCH 14/33] chore: updated yml

---
 .github/workflows/security-scan.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 348d2ce9..cfe9fe59 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -138,10 +138,17 @@ jobs:
           echo "$COMMENT_BODY" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
-      - name: Upload all SARIF reports to GitHub Security
+      - name: Upload amd64 SARIF report
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: artifacts
+          sarif_file: artifacts/scan-artifacts-amd64/trivy-results-amd64.sarif
+          category: trivy-amd64
+
+      - name: Upload arm64 SARIF report
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: artifacts/scan-artifacts-arm64/trivy-results-arm64.sarif
+          category: trivy-arm64
 
       - name: Comment on PR
         if: github.event_name == 'pull_request'

From b09924056acbaedf1ab01d03d31a994236bd20d4 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 19:33:06 +0530
Subject: [PATCH 15/33] chore: updated workflow

---
 .github/workflows/security-scan.yml | 60 ++++++++++++++++++-----------
 1 file changed, 38 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index cfe9fe59..e528d4c9 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -9,9 +9,31 @@ on:
       - main
 
 jobs:
-  scan:
-    name: Scan ${{ matrix.arch }}
+  govulncheck:
+    name: Go Vulnerability Check
     runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+          cache-dependency-path: go.sum
+
+      - name: Download Go modules
+        run: go mod download
+
+      - name: Run govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+  scan-images:
+    name: Scan Docker Images
+    runs-on: ubuntu-24.04
+    needs: [govulncheck]
     strategy:
       fail-fast: false
       matrix:
@@ -22,7 +44,6 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up QEMU
-        # Required to build the non-native architecture (arm64 on an amd64 runner)
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
@@ -62,7 +83,7 @@ jobs:
           exit-code: '1'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH'
-          scanners: 'vuln'
+          scanners: 'vuln,misconfig'
         continue-on-error: true
 
       - name: Generate Trivy table for comments
@@ -72,12 +93,11 @@ jobs:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'table'
-          dependency-tree: true
           output: 'trivy-table-${{ matrix.arch }}.txt'
           exit-code: '0'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln'
+          scanners: 'vuln,misconfig'
 
       - name: Upload Scan Artifacts
         if: always()
@@ -92,7 +112,7 @@ jobs:
   summarize:
     name: Summarize and Report
     runs-on: ubuntu-24.04
-    needs: [scan]
+    needs: [scan-images]
     if: always()
 
     permissions:
@@ -111,27 +131,27 @@ jobs:
         run: |
           AMD64_TABLE="artifacts/scan-artifacts-amd64/trivy-table-amd64.txt"
           ARM64_TABLE="artifacts/scan-artifacts-arm64/trivy-table-arm64.txt"
-          COMMENT_BODY="## 🔒 Trivy Security Scan Results\n\n"
+          COMMENT_BODY="## 🔒 Security Scan Results\n\n"
           VULNS_FOUND=false
 
           if [ -f "$AMD64_TABLE" ]; then
             VULNS_FOUND=true
-            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in x86_64 (amd64) Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $AMD64_TABLE)\n\`\`\`\n\n</details>\n\n"
+            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Issues found in x86_64 (amd64) Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $AMD64_TABLE)\n\`\`\`\n\n</details>\n\n"
           else
-            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in x86_64 (amd64) Image\n"
+            COMMENT_BODY="${COMMENT_BODY}### ✅ No issues found in x86_64 (amd64) Image\n"
           fi
 
           if [ -f "$ARM64_TABLE" ]; then
             VULNS_FOUND=true
-            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in arm64 Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $ARM64_TABLE)\n\`\`\`\n\n</details>\n\n"
+            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Issues found in arm64 Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $ARM64_TABLE)\n\`\`\`\n\n</details>\n\n"
           else
-            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in arm64 Image\n"
+            COMMENT_BODY="${COMMENT_BODY}### ✅ No issues found in arm64 Image\n"
           fi
 
           if [ "$VULNS_FOUND" = true ]; then
             COMMENT_BODY="${COMMENT_BODY}\nPlease review the findings and check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for full details."
           else
-            COMMENT_BODY="## 🔒 Trivy Security Scan Results\n\n✅ All scans passed. No vulnerabilities found in amd64 or arm64 images."
+            COMMENT_BODY="## 🔒 Security Scan Results\n\n✅ All scans passed. No vulnerabilities or misconfigurations found in amd64 or arm64 images."
           fi
           
           echo "comment_body<<EOF" >> $GITHUB_OUTPUT
@@ -139,19 +159,21 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Upload amd64 SARIF report
+        if: success() || failure()
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: artifacts/scan-artifacts-amd64/trivy-results-amd64.sarif
           category: trivy-amd64
 
       - name: Upload arm64 SARIF report
+        if: success() || failure()
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: artifacts/scan-artifacts-arm64/trivy-results-arm64.sarif
           category: trivy-arm64
 
       - name: Comment on PR
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && (needs.scan-images.result == 'failure')
         uses: actions/github-script@v7
         with:
           script: |
@@ -163,14 +185,8 @@ jobs:
               body: body
             });
 
-      - name: Clean up Docker images
-        if: always()
-        run: |
-          echo "Cleaning up Docker images..."
-          docker image prune -a -f || true
-
-      - name: Check scan results and fail workflow if needed
-        if: ${{ needs.scan.result == 'failure' }}
+      - name: Check overall results and fail workflow if needed
+        if: ${{ needs.scan-images.result == 'failure' }}
         run: |
           echo "❌ One or more security scans failed."
           exit 1

From 99cf99dff435425d27a102373f384d7c23973850 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 19:43:41 +0530
Subject: [PATCH 16/33] chore: updated workflow

---
 .github/workflows/security-scan.yml | 144 +++++++++++++++-------------
 1 file changed, 76 insertions(+), 68 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index e528d4c9..06e0fb20 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -9,8 +9,8 @@ on:
       - main
 
 jobs:
-  govulncheck:
-    name: Go Vulnerability Check
+  scan-go-dependencies:
+    name: Scan Go Dependencies
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -25,15 +25,46 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
-      - name: Run govulncheck
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
+      - name: Run Trivy FS Scan for Go Modules
+        uses: aquasecurity/trivy-action@0.32.0
+        id: trivy_fs_scan
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'sarif'
+          output: 'trivy-go-results.sarif'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH'
+          vuln-type: 'library'
+        continue-on-error: true
+
+      - name: Generate Trivy table for comments
+        if: ${{ steps.trivy_fs_scan.outcome == 'failure' }}
+        uses:  aquasecurity/trivy-action@0.32.0
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'table'
+          output: 'trivy-go-table.txt'
+          exit-code: '0'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          vuln-type: 'library'
+
+      - name: Upload Go Scan Artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: go-scan-artifacts
+          path: |
+            trivy-go-results.sarif
+            trivy-go-table.txt
+          if-no-files-found: ignore
 
   scan-images:
-    name: Scan Docker Images
+    name: Scan OS Packages in Docker Images
     runs-on: ubuntu-24.04
-    needs: [govulncheck]
     strategy:
       fail-fast: false
       matrix:
@@ -49,14 +80,6 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Cache Docker layers
-        uses: actions/cache@v4
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-
       - name: Build Docker image for ${{ matrix.arch }}
         uses: docker/build-push-action@v5
         with:
@@ -64,55 +87,48 @@ jobs:
           platforms: linux/${{ matrix.arch }}
           tags: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
           load: true
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
 
-      - name: Move cache
-        run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
-
-      - name: Run Trivy Scan
-        uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_scan
+      - name: Run Trivy Image Scan for OS packages
+        uses:  aquasecurity/trivy-action@0.32.0
+        id: trivy_image_scan
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'sarif'
-          output: 'trivy-results-${{ matrix.arch }}.sarif'
+          output: 'trivy-os-results-${{ matrix.arch }}.sarif'
           exit-code: '1'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH'
-          scanners: 'vuln,misconfig'
+          vuln-type: 'os'
         continue-on-error: true
 
       - name: Generate Trivy table for comments
-        if: ${{ steps.trivy_scan.outcome == 'failure' }}
-        uses: aquasecurity/trivy-action@0.32.0
+        if: ${{ steps.trivy_image_scan.outcome == 'failure' }}
+        uses:  aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'table'
-          output: 'trivy-table-${{ matrix.arch }}.txt'
+          output: 'trivy-os-table-${{ matrix.arch }}.txt'
           exit-code: '0'
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          scanners: 'vuln,misconfig'
+          vuln-type: 'os'
 
-      - name: Upload Scan Artifacts
+      - name: Upload OS Scan Artifacts
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: scan-artifacts-${{ matrix.arch }}
+          name: os-scan-artifacts-${{ matrix.arch }}
           path: |
-            trivy-results-${{ matrix.arch }}.sarif
-            trivy-table-${{ matrix.arch }}.txt
+            trivy-os-results-${{ matrix.arch }}.sarif
+            trivy-os-table-${{ matrix.arch }}.txt
           if-no-files-found: ignore
 
   summarize:
     name: Summarize and Report
     runs-on: ubuntu-24.04
-    needs: [scan-images]
+    needs: [scan-go-dependencies, scan-images]
     if: always()
 
     permissions:
@@ -129,51 +145,43 @@ jobs:
       - name: Prepare comment
         id: prep_comment
         run: |
-          AMD64_TABLE="artifacts/scan-artifacts-amd64/trivy-table-amd64.txt"
-          ARM64_TABLE="artifacts/scan-artifacts-arm64/trivy-table-arm64.txt"
+          GO_TABLE="artifacts/go-scan-artifacts/trivy-go-table.txt"
+          AMD64_TABLE="artifacts/os-scan-artifacts-amd64/trivy-os-table-amd64.txt"
+          ARM64_TABLE="artifacts/os-scan-artifacts-arm64/trivy-os-table-arm64.txt"
           COMMENT_BODY="## 🔒 Security Scan Results\n\n"
-          VULNS_FOUND=false
-
-          if [ -f "$AMD64_TABLE" ]; then
-            VULNS_FOUND=true
-            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Issues found in x86_64 (amd64) Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $AMD64_TABLE)\n\`\`\`\n\n</details>\n\n"
-          else
-            COMMENT_BODY="${COMMENT_BODY}### ✅ No issues found in x86_64 (amd64) Image\n"
-          fi
-
-          if [ -f "$ARM64_TABLE" ]; then
-            VULNS_FOUND=true
-            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Issues found in arm64 Image\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $ARM64_TABLE)\n\`\`\`\n\n</details>\n\n"
+          
+          # Go Dependencies Section
+          if [ -f "$GO_TABLE" ]; then
+            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in Go Dependencies\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $GO_TABLE)\n\`\`\`\n\n</details>\n\n"
           else
-            COMMENT_BODY="${COMMENT_BODY}### ✅ No issues found in arm64 Image\n"
+            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in Go Dependencies\n"
           fi
 
-          if [ "$VULNS_FOUND" = true ]; then
-            COMMENT_BODY="${COMMENT_BODY}\nPlease review the findings and check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for full details."
+          # OS Packages Section
+          COMMENT_BODY="${COMMENT_BODY}--- \n\n"
+          if [ -f "$AMD64_TABLE" ] || [ -f "$ARM64_TABLE" ]; then
+            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in OS Packages\n"
+            if [ -f "$AMD64_TABLE" ]; then
+              COMMENT_BODY="${COMMENT_BODY}**x86_64 (amd64) Image:**\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $AMD64_TABLE)\n\`\`\`\n\n</details>\n"
+            fi
+            if [ -f "$ARM64_TABLE" ]; then
+              COMMENT_BODY="${COMMENT_BODY}**arm64 Image:**\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $ARM64_TABLE)\n\`\`\`\n\n</details>\n"
+            fi
           else
-            COMMENT_BODY="## 🔒 Security Scan Results\n\n✅ All scans passed. No vulnerabilities or misconfigurations found in amd64 or arm64 images."
+            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in OS Packages for either architecture\n"
           fi
           
           echo "comment_body<<EOF" >> $GITHUB_OUTPUT
           echo "$COMMENT_BODY" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
-      - name: Upload amd64 SARIF report
-        if: success() || failure()
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: artifacts/scan-artifacts-amd64/trivy-results-amd64.sarif
-          category: trivy-amd64
-
-      - name: Upload arm64 SARIF report
-        if: success() || failure()
+      - name: Upload all SARIF reports to GitHub Security
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: artifacts/scan-artifacts-arm64/trivy-results-arm64.sarif
-          category: trivy-arm64
+          sarif_file: artifacts
 
       - name: Comment on PR
-        if: github.event_name == 'pull_request' && (needs.scan-images.result == 'failure')
+        if: github.event_name == 'pull_request' && (needs.scan-go-dependencies.result == 'failure' || needs.scan-images.result == 'failure')
         uses: actions/github-script@v7
         with:
           script: |
@@ -186,7 +194,7 @@ jobs:
             });
 
       - name: Check overall results and fail workflow if needed
-        if: ${{ needs.scan-images.result == 'failure' }}
+        if: ${{ needs.scan-go-dependencies.result == 'failure' || needs.scan-images.result == 'failure' }}
         run: |
           echo "❌ One or more security scans failed."
           exit 1

From 290a5beb2f22e3091ab4ccfd82a118893d467f1c Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Thu, 14 Aug 2025 20:33:18 +0530
Subject: [PATCH 17/33] chore: updating workflow

---
 .github/workflows/security-scan.yml | 219 +++++++++-------------------
 1 file changed, 69 insertions(+), 150 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 06e0fb20..5b70113a 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -2,15 +2,18 @@ name: Security Scan
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
   pull_request:
-    branches:
-      - main
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+  security-events: write
 
 jobs:
-  scan-go-dependencies:
-    name: Scan Go Dependencies
+  scan-fs:
+    name: Scan Go Dependencies (FS)
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -19,57 +22,63 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: "1.23"
           cache-dependency-path: go.sum
 
       - name: Download Go modules
         run: go mod download
 
-      - name: Run Trivy FS Scan for Go Modules
+      - name: Trivy cache cleanup
+        run: trivy clean --all || true
+
+      - name: Trivy FS Scan
         uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_fs_scan
+        id: trivy_fs
         with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-go-results.sarif'
-          exit-code: '1'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH'
-          vuln-type: 'library'
+          scan-type: fs
+          scan-ref: .
+          vuln-type: library
+          list-all-pkgs: true
+          dependency-tree: true
+          format: sarif
+          output: trivy-fs.sarif
+          severity: CRITICAL,HIGH
+          ignore-unfixed: false
+          exit-code: 1
         continue-on-error: true
 
-      - name: Generate Trivy table for comments
-        if: ${{ steps.trivy_fs_scan.outcome == 'failure' }}
-        uses:  aquasecurity/trivy-action@0.32.0
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'table'
-          output: 'trivy-go-table.txt'
-          exit-code: '0'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          vuln-type: 'library'
-
-      - name: Upload Go Scan Artifacts
+      - name: Generate FS Table
         if: always()
+        uses: aquasecurity/trivy-action@0.32.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          vuln-type: library
+          list-all-pkgs: true
+          dependency-tree: true
+          format: table
+          output: trivy-fs.txt
+          severity: CRITICAL,HIGH,MEDIUM,LOW
+          ignore-unfixed: false
+          exit-code: 0
+
+      - name: Upload FS scan artifacts
         uses: actions/upload-artifact@v4
+        if: always()
         with:
-          name: go-scan-artifacts
+          name: fs-scan
           path: |
-            trivy-go-results.sarif
-            trivy-go-table.txt
-          if-no-files-found: ignore
+            trivy-fs.sarif
+            trivy-fs.txt
 
-  scan-images:
-    name: Scan OS Packages in Docker Images
+  scan-image:
+    name: Scan Docker Images
     runs-on: ubuntu-24.04
+    needs: scan-fs
     strategy:
       fail-fast: false
       matrix:
         arch: [amd64, arm64]
-    
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -80,121 +89,31 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build Docker image for ${{ matrix.arch }}
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/${{ matrix.arch }}
-          tags: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
-          load: true
+      - name: Build Docker image
+        run: |
+          docker build --build-arg TARGETARCH=${{ matrix.arch }} \
+            --platform linux/${{ matrix.arch }} \
+            -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
 
-      - name: Run Trivy Image Scan for OS packages
-        uses:  aquasecurity/trivy-action@0.32.0
-        id: trivy_image_scan
+      - name: Trivy Image Scan
+        uses: aquasecurity/trivy-action@0.32.0
+        id: trivy_img
         with:
-          scan-type: 'image'
-          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
-          format: 'sarif'
-          output: 'trivy-os-results-${{ matrix.arch }}.sarif'
-          exit-code: '1'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH'
-          vuln-type: 'os'
+          scan-type: image
+          image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
+          vuln-type: os,library
+          list-all-pkgs: true
+          dependency-tree: true
+          format: sarif
+          output: trivy-image-${{ matrix.arch }}.sarif
+          severity: CRITICAL,HIGH
+          ignore-unfixed: false
+          exit-code: 1
         continue-on-error: true
 
-      - name: Generate Trivy table for comments
-        if: ${{ steps.trivy_image_scan.outcome == 'failure' }}
-        uses:  aquasecurity/trivy-action@0.32.0
-        with:
-          scan-type: 'image'
-          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
-          format: 'table'
-          output: 'trivy-os-table-${{ matrix.arch }}.txt'
-          exit-code: '0'
-          ignore-unfixed: true
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-          vuln-type: 'os'
-
-      - name: Upload OS Scan Artifacts
+      - name: Generate Image Table
         if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: os-scan-artifacts-${{ matrix.arch }}
-          path: |
-            trivy-os-results-${{ matrix.arch }}.sarif
-            trivy-os-table-${{ matrix.arch }}.txt
-          if-no-files-found: ignore
-
-  summarize:
-    name: Summarize and Report
-    runs-on: ubuntu-24.04
-    needs: [scan-go-dependencies, scan-images]
-    if: always()
-
-    permissions:
-      security-events: write
-      pull-requests: write
-      contents: read
-
-    steps:
-      - name: Download all scan artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Prepare comment
-        id: prep_comment
-        run: |
-          GO_TABLE="artifacts/go-scan-artifacts/trivy-go-table.txt"
-          AMD64_TABLE="artifacts/os-scan-artifacts-amd64/trivy-os-table-amd64.txt"
-          ARM64_TABLE="artifacts/os-scan-artifacts-arm64/trivy-os-table-arm64.txt"
-          COMMENT_BODY="## 🔒 Security Scan Results\n\n"
-          
-          # Go Dependencies Section
-          if [ -f "$GO_TABLE" ]; then
-            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in Go Dependencies\n\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $GO_TABLE)\n\`\`\`\n\n</details>\n\n"
-          else
-            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in Go Dependencies\n"
-          fi
-
-          # OS Packages Section
-          COMMENT_BODY="${COMMENT_BODY}--- \n\n"
-          if [ -f "$AMD64_TABLE" ] || [ -f "$ARM64_TABLE" ]; then
-            COMMENT_BODY="${COMMENT_BODY}### ⚠️ Vulnerabilities found in OS Packages\n"
-            if [ -f "$AMD64_TABLE" ]; then
-              COMMENT_BODY="${COMMENT_BODY}**x86_64 (amd64) Image:**\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $AMD64_TABLE)\n\`\`\`\n\n</details>\n"
-            fi
-            if [ -f "$ARM64_TABLE" ]; then
-              COMMENT_BODY="${COMMENT_BODY}**arm64 Image:**\n<details><summary>Click to view summary</summary>\n\n\`\`\`\n$(cat $ARM64_TABLE)\n\`\`\`\n\n</details>\n"
-            fi
-          else
-            COMMENT_BODY="${COMMENT_BODY}### ✅ No vulnerabilities found in OS Packages for either architecture\n"
-          fi
-          
-          echo "comment_body<<EOF" >> $GITHUB_OUTPUT
-          echo "$COMMENT_BODY" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Upload all SARIF reports to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: artifacts
-
-      - name: Comment on PR
-        if: github.event_name == 'pull_request' && (needs.scan-go-dependencies.result == 'failure' || needs.scan-images.result == 'failure')
-        uses: actions/github-script@v7
+        uses: aquasecurity/trivy-action@0.32.0
         with:
-          script: |
-            const body = `${{ steps.prep_comment.outputs.comment_body }}`;
-            github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: body
-            });
-
-      - name: Check overall results and fail workflow if needed
-        if: ${{ needs.scan-go-dependencies.result == 'failure' || needs.scan-images.result == 'failure' }}
-        run: |
-          echo "❌ One or more security scans failed."
-          exit 1
+          scan-type: image
+          image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
\ No newline at end of file

From 48b3286f2187d2975b9b9eb1fa4e00b58b431ad3 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 12:32:36 +0530
Subject: [PATCH 18/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 5b70113a..3f5c7f8f 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.23"
+          go-version: "1.23.7"
           cache-dependency-path: go.sum
 
       - name: Download Go modules
@@ -116,4 +116,4 @@ jobs:
         uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: image
-          image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
\ No newline at end of file
+          image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}

From debbc431a257391c1eb7773602abe4d73680a850 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 14:12:46 +0530
Subject: [PATCH 19/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 3f5c7f8f..3f5f313e 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -2,9 +2,13 @@ name: Security Scan
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - dev
   pull_request:
-    branches: [main]
+    branches:
+      - main
+      - dev
 
 permissions:
   contents: read

From 7c2d1ffc2461fcec97e0f22c0cb11fbe2126333d Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 15:20:53 +0530
Subject: [PATCH 20/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 3f5f313e..8820b0fb 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -41,9 +41,8 @@ jobs:
         with:
           scan-type: fs
           scan-ref: .
-          vuln-type: library
+          vuln-type: library,os
           list-all-pkgs: true
-          dependency-tree: true
           format: sarif
           output: trivy-fs.sarif
           severity: CRITICAL,HIGH
@@ -57,7 +56,7 @@ jobs:
         with:
           scan-type: fs
           scan-ref: .
-          vuln-type: library
+          vuln-type: library,os
           list-all-pkgs: true
           dependency-tree: true
           format: table
@@ -107,7 +106,6 @@ jobs:
           image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
           vuln-type: os,library
           list-all-pkgs: true
-          dependency-tree: true
           format: sarif
           output: trivy-image-${{ matrix.arch }}.sarif
           severity: CRITICAL,HIGH

From ed8790b7c80e7c5bebdc8d0d0cde1329df852533 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 15:36:23 +0530
Subject: [PATCH 21/33] chore: Update security-scan.yml

---
 .github/workflows/security-scan.yml | 119 +++++++++-------------------
 1 file changed, 39 insertions(+), 80 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 8820b0fb..60f7b249 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -11,9 +11,9 @@ on:
       - dev
 
 permissions:
-  contents: read
-  pull-requests: write
+  contents: write      
   security-events: write
+  pull-requests: write
 
 jobs:
   scan-fs:
@@ -31,91 +31,50 @@ jobs:
 
       - name: Download Go modules
         run: go mod download
-
-      - name: Trivy cache cleanup
-        run: trivy clean --all || true
-
-      - name: Trivy FS Scan
+        
+      - name: 🛑 Scan for vulnerabilities (Blocker)
+        id: scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_fs
         with:
-          scan-type: fs
-          scan-ref: .
-          vuln-type: library,os
-          list-all-pkgs: true
-          format: sarif
-          output: trivy-fs.sarif
-          severity: CRITICAL,HIGH
-          ignore-unfixed: false
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
           exit-code: 1
+          ignore-unfixed: true
         continue-on-error: true
-
-      - name: Generate FS Table
-        if: always()
+      - name: Generate report for PR comment
+        if: steps.scan_blocker.outcome == 'failure'
         uses: aquasecurity/trivy-action@0.32.0
         with:
-          scan-type: fs
-          scan-ref: .
-          vuln-type: library,os
-          list-all-pkgs: true
-          dependency-tree: true
-          format: table
-          output: trivy-fs.txt
-          severity: CRITICAL,HIGH,MEDIUM,LOW
-          ignore-unfixed: false
-          exit-code: 0
-
-      - name: Upload FS scan artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'table'
+          output: 'trivy-comment-report.txt'
+          severity: 'CRITICAL,HIGH'
+          exit-code: 0 
+          ignore-unfixed: true
+          
+      - name: Post vulnerability report on PR
+        if: steps.scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'
+        uses: peter-evans/create-or-update-comment@v4
         with:
-          name: fs-scan
-          path: |
-            trivy-fs.sarif
-            trivy-fs.txt
-
-  scan-image:
-    name: Scan Docker Images
-    runs-on: ubuntu-24.04
-    needs: scan-fs
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [amd64, arm64]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build Docker image
-        run: |
-          docker build --build-arg TARGETARCH=${{ matrix.arch }} \
-            --platform linux/${{ matrix.arch }} \
-            -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
-
-      - name: Trivy Image Scan
-        uses: aquasecurity/trivy-action@0.32.0
-        id: trivy_img
-        with:
-          scan-type: image
-          image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
-          vuln-type: os,library
-          list-all-pkgs: true
-          format: sarif
-          output: trivy-image-${{ matrix.arch }}.sarif
-          severity: CRITICAL,HIGH
-          ignore-unfixed: false
-          exit-code: 1
-        continue-on-error: true
-
-      - name: Generate Image Table
+          issue-number: ${{ github.event.pull_request.number }}
+          body-file: trivy-comment-report.txt
+   
+          edit-mode: replace
+      - name: ✅ Scan and submit to GitHub Dependency Graph
         if: always()
         uses: aquasecurity/trivy-action@0.32.0
         with:
-          scan-type: image
-          image-ref: my-app-scan:${{ github.sha }}-${{ matrix.arch }}
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'github'
+          exit-code: 0
+
+      - name: Fail job if vulnerabilities were found
+        if: steps.scan_blocker.outcome == 'failure'
+        run: |
+          echo "Failing the job due to critical or high severity vulnerabilities."
+          exit 1

From 84a922ebfbd4ef79c950e6c17bf7b367474bc16d Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 15:39:58 +0530
Subject: [PATCH 22/33] chore: Update security-scan.yml

---
 .github/workflows/security-scan.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 60f7b249..5d579db6 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -14,7 +14,7 @@ permissions:
   contents: write      
   security-events: write
   pull-requests: write
-
+  
 jobs:
   scan-fs:
     name: Scan Go Dependencies (FS)
@@ -31,29 +31,32 @@ jobs:
 
       - name: Download Go modules
         run: go mod download
-        
+
       - name: 🛑 Scan for vulnerabilities (Blocker)
         id: scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
+          skip-dirs: 'examples' # Skips the examples folder
           format: 'sarif'
           output: 'trivy-results.sarif'
           severity: 'CRITICAL,HIGH'
           exit-code: 1
           ignore-unfixed: true
         continue-on-error: true
+
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
         uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
+          skip-dirs: 'examples' # Skips the examples folder
           format: 'table'
           output: 'trivy-comment-report.txt'
           severity: 'CRITICAL,HIGH'
-          exit-code: 0 
+          exit-code: 0
           ignore-unfixed: true
           
       - name: Post vulnerability report on PR
@@ -62,14 +65,15 @@ jobs:
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body-file: trivy-comment-report.txt
-   
           edit-mode: replace
+
       - name: ✅ Scan and submit to GitHub Dependency Graph
         if: always()
         uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
+          skip-dirs: 'examples' # Skips the examples folder
           format: 'github'
           exit-code: 0
 

From 0c2392db2e390d860f3edc4cb2cf195c418b669f Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 15:46:39 +0530
Subject: [PATCH 23/33] chore: update security-scan.yml

---
 .github/workflows/security-scan.yml | 83 +++++++++++++++++++++++++----
 1 file changed, 74 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 5d579db6..328df296 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -11,10 +11,10 @@ on:
       - dev
 
 permissions:
-  contents: write      
+  contents: write        
   security-events: write
   pull-requests: write
-  
+
 jobs:
   scan-fs:
     name: Scan Go Dependencies (FS)
@@ -38,9 +38,9 @@ jobs:
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          skip-dirs: 'examples' # Skips the examples folder
+          skip-dirs: 'examples'
           format: 'sarif'
-          output: 'trivy-results.sarif'
+          output: 'trivy-fs-results.sarif'
           severity: 'CRITICAL,HIGH'
           exit-code: 1
           ignore-unfixed: true
@@ -48,13 +48,14 @@ jobs:
 
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
+        id: generate_fs_report
         uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          skip-dirs: 'examples' # Skips the examples folder
+          skip-dirs: 'examples'
           format: 'table'
-          output: 'trivy-comment-report.txt'
+          output: 'trivy-fs-comment-report.txt'
           severity: 'CRITICAL,HIGH'
           exit-code: 0
           ignore-unfixed: true
@@ -64,8 +65,9 @@ jobs:
         uses: peter-evans/create-or-update-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
-          body-file: trivy-comment-report.txt
+          body-file: trivy-fs-comment-report.txt
           edit-mode: replace
+          unique-id-for-comment: fs-scan-results
 
       - name: ✅ Scan and submit to GitHub Dependency Graph
         if: always()
@@ -73,12 +75,75 @@ jobs:
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          skip-dirs: 'examples' # Skips the examples folder
+          skip-dirs: 'examples'
           format: 'github'
           exit-code: 0
 
       - name: Fail job if vulnerabilities were found
         if: steps.scan_blocker.outcome == 'failure'
         run: |
-          echo "Failing the job due to critical or high severity vulnerabilities."
+          echo "Failing the job due to filesystem vulnerabilities."
+          exit 1
+
+  scan-image:
+    name: Scan Docker Images
+    runs-on: ubuntu-24.04
+    needs: scan-fs
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [amd64, arm64]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up QEMU and Docker Buildx
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker image
+        run: |
+          docker build --build-arg TARGETARCH=${{ matrix.arch }} \
+            --platform linux/${{ matrix.arch }} \
+            -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
+
+      - name: 🛑 Scan image for vulnerabilities (Blocker)
+        id: image_scan_blocker
+        uses: aquasecurity/trivy-action@0.32.0
+        with:
+          scan-type: 'image'
+          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
+          format: 'sarif'
+          output: 'trivy-image-results.sarif'
+          severity: 'CRITICAL,HIGH'
+          exit-code: 1
+          ignore-unfixed: true
+        continue-on-error: true
+
+      - name: Generate report for PR comment
+        if: steps.image_scan_blocker.outcome == 'failure'
+        uses: aquasecurity/trivy-action@0.32.0
+        with:
+          scan-type: 'image'
+          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
+          format: 'table'
+          output: 'trivy-image-comment-report.txt'
+          severity: 'CRITICAL,HIGH'
+          exit-code: 0
+          ignore-unfixed: true
+      
+      - name: Post vulnerability report on PR
+        if: steps.image_scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body-file: trivy-image-comment-report.txt
+          edit-mode: replace
+          unique-id-for-comment: image-scan-${{ matrix.arch }}
+          
+      - name: Fail job if vulnerabilities were found
+        if: steps.image_scan_blocker.outcome == 'failure'
+        run: |
+          echo "Failing the job due to image vulnerabilities in ${{ matrix.arch }} build."
           exit 1

From 5a9b722d93ecd33c69fd05cf0db1f8ea3f320a33 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 15:53:11 +0530
Subject: [PATCH 24/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 328df296..48da4e29 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -11,7 +11,7 @@ on:
       - dev
 
 permissions:
-  contents: write        
+  contents: write   
   security-events: write
   pull-requests: write
 
@@ -41,14 +41,13 @@ jobs:
           skip-dirs: 'examples'
           format: 'sarif'
           output: 'trivy-fs-results.sarif'
-          severity: 'CRITICAL,HIGH'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
           ignore-unfixed: true
         continue-on-error: true
 
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
-        id: generate_fs_report
         uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
@@ -56,7 +55,7 @@ jobs:
           skip-dirs: 'examples'
           format: 'table'
           output: 'trivy-fs-comment-report.txt'
-          severity: 'CRITICAL,HIGH'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 0
           ignore-unfixed: true
           
@@ -85,6 +84,7 @@ jobs:
           echo "Failing the job due to filesystem vulnerabilities."
           exit 1
 
+  # JOB 2: Image Scan
   scan-image:
     name: Scan Docker Images
     runs-on: ubuntu-24.04
@@ -116,7 +116,7 @@ jobs:
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'sarif'
           output: 'trivy-image-results.sarif'
-          severity: 'CRITICAL,HIGH'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
           ignore-unfixed: true
         continue-on-error: true
@@ -129,7 +129,7 @@ jobs:
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
           format: 'table'
           output: 'trivy-image-comment-report.txt'
-          severity: 'CRITICAL,HIGH'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 0
           ignore-unfixed: true
       

From 9fe3e83abe2d4aa29bcf104c672beb78640c05aa Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 16:43:52 +0530
Subject: [PATCH 25/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 48da4e29..ea4607d1 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: 🛑 Scan for vulnerabilities (Blocker)
         id: scan_blocker
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.67.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -48,7 +48,7 @@ jobs:
 
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.67.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -70,7 +70,7 @@ jobs:
 
       - name: ✅ Scan and submit to GitHub Dependency Graph
         if: always()
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.67.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -110,7 +110,7 @@ jobs:
 
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.67.0
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
@@ -123,7 +123,7 @@ jobs:
 
       - name: Generate report for PR comment
         if: steps.image_scan_blocker.outcome == 'failure'
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.67.0
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'

From 467287fb5b0a3dbc6fc2d38efae4eadb8625cef1 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 16:48:19 +0530
Subject: [PATCH 26/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index ea4607d1..48da4e29 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: 🛑 Scan for vulnerabilities (Blocker)
         id: scan_blocker
-        uses: aquasecurity/trivy-action@0.67.0
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -48,7 +48,7 @@ jobs:
 
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
-        uses: aquasecurity/trivy-action@0.67.0
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -70,7 +70,7 @@ jobs:
 
       - name: ✅ Scan and submit to GitHub Dependency Graph
         if: always()
-        uses: aquasecurity/trivy-action@0.67.0
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -110,7 +110,7 @@ jobs:
 
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
-        uses: aquasecurity/trivy-action@0.67.0
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
@@ -123,7 +123,7 @@ jobs:
 
       - name: Generate report for PR comment
         if: steps.image_scan_blocker.outcome == 'failure'
-        uses: aquasecurity/trivy-action@0.67.0
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'

From cb0dbc53a2c7fb9096b9c931f3ff5a4f5ddd3cb0 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 17:20:09 +0530
Subject: [PATCH 27/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 48da4e29..47336378 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -43,7 +43,7 @@ jobs:
           output: 'trivy-fs-results.sarif'
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
-          ignore-unfixed: true
+          ignore-unfixed: false
         continue-on-error: true
 
       - name: Generate report for PR comment
@@ -57,7 +57,7 @@ jobs:
           output: 'trivy-fs-comment-report.txt'
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 0
-          ignore-unfixed: true
+          ignore-unfixed: false
           
       - name: Post vulnerability report on PR
         if: steps.scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'
@@ -118,7 +118,7 @@ jobs:
           output: 'trivy-image-results.sarif'
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
-          ignore-unfixed: true
+          ignore-unfixed: false
         continue-on-error: true
 
       - name: Generate report for PR comment
@@ -131,7 +131,7 @@ jobs:
           output: 'trivy-image-comment-report.txt'
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 0
-          ignore-unfixed: true
+          ignore-unfixed: false
       
       - name: Post vulnerability report on PR
         if: steps.image_scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'

From f2a950fdb4f47da62e9e9c8a808960f96dc70631 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 17:40:19 +0530
Subject: [PATCH 28/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 47336378..c4ae2c9e 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -11,7 +11,7 @@ on:
       - dev
 
 permissions:
-  contents: write   
+  contents: write    
   security-events: write
   pull-requests: write
 
@@ -32,6 +32,8 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
+      # This is the primary scan for your Go module vulnerabilities.
+      # The `trivy-db-repository` flag ensures it downloads the latest vulnerability database.
       - name: 🛑 Scan for vulnerabilities (Blocker)
         id: scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
@@ -44,7 +46,9 @@ jobs:
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
           ignore-unfixed: false
-        continue-on-error: true
+          # ADD THIS LINE to force a fresh DB download
+          trivy-db-repository: 'ghcr.io/aquasecurity/trivy-db'
+          continue-on-error: true
 
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
@@ -108,6 +112,8 @@ jobs:
             --platform linux/${{ matrix.arch }} \
             -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
 
+      # This scan checks the final image, including the Go standard library version.
+      # The `trivy-db-repository` flag ensures it downloads the latest vulnerability database.
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
@@ -119,7 +125,9 @@ jobs:
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
           ignore-unfixed: false
-        continue-on-error: true
+          # ADD THIS LINE to force a fresh DB download
+          trivy-db-repository: 'ghcr.io/aquasecurity/trivy-db'
+          continue-on-error: true
 
       - name: Generate report for PR comment
         if: steps.image_scan_blocker.outcome == 'failure'
@@ -138,7 +146,7 @@ jobs:
         uses: peter-evans/create-or-update-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
-          body-file: trivy-image-comment-report.txt
+          body-file: 'trivy-image-comment-report.txt'
           edit-mode: replace
           unique-id-for-comment: image-scan-${{ matrix.arch }}
           

From d24b615d1d854e5957304f8f2cc095a5c3b0b8bd Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 17:47:21 +0530
Subject: [PATCH 29/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index c4ae2c9e..9be0176a 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,11 +32,12 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
-      # This is the primary scan for your Go module vulnerabilities.
-      # The `trivy-db-repository` flag ensures it downloads the latest vulnerability database.
       - name: 🛑 Scan for vulnerabilities (Blocker)
         id: scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
+        continue-on-error: true
+        env:
+          TRIVY_RESET: 'true'
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -46,9 +47,6 @@ jobs:
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
           ignore-unfixed: false
-          # ADD THIS LINE to force a fresh DB download
-          trivy-db-repository: 'ghcr.io/aquasecurity/trivy-db'
-          continue-on-error: true
 
       - name: Generate report for PR comment
         if: steps.scan_blocker.outcome == 'failure'
@@ -113,10 +111,15 @@ jobs:
             -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
 
       # This scan checks the final image, including the Go standard library version.
-      # The `trivy-db-repository` flag ensures it downloads the latest vulnerability database.
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
+        # Moved 'continue-on-error' to the step level where it belongs.
+        continue-on-error: true
+        # Use the 'env' block to pass environment variables to the Trivy binary.
+        env:
+          # TRIVY_RESET forces Trivy to clear all caches and download a fresh database.
+          TRIVY_RESET: 'true'
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
@@ -125,9 +128,6 @@ jobs:
           severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
           exit-code: 1
           ignore-unfixed: false
-          # ADD THIS LINE to force a fresh DB download
-          trivy-db-repository: 'ghcr.io/aquasecurity/trivy-db'
-          continue-on-error: true
 
       - name: Generate report for PR comment
         if: steps.image_scan_blocker.outcome == 'failure'

From 060e4ed6c4f9ed6533b9633e7121cb1a6ce08ca0 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 18 Aug 2025 17:52:50 +0530
Subject: [PATCH 30/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 9be0176a..689c93ae 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,12 +32,18 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
+      # FIX 1: Add a step to clear the Trivy cache directory before scanning.
+      # This ensures a fresh vulnerability database is downloaded every time.
+      - name: Clear Trivy cache
+        run: rm -rf ${{ github.workspace }}/.cache/trivy
+
+      # This is the primary scan for your Go module vulnerabilities.
       - name: 🛑 Scan for vulnerabilities (Blocker)
         id: scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
+        # Moved 'continue-on-error' to the step level where it belongs.
         continue-on-error: true
-        env:
-          TRIVY_RESET: 'true'
+        # FIX 1: Removed the deprecated 'TRIVY_RESET' environment variable.
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -68,7 +74,8 @@ jobs:
           issue-number: ${{ github.event.pull_request.number }}
           body-file: trivy-fs-comment-report.txt
           edit-mode: replace
-          unique-id-for-comment: fs-scan-results
+          # FIX 2: Removed the invalid 'unique-id-for-comment' input.
+          # The action automatically finds and updates its own previous comments.
 
       - name: ✅ Scan and submit to GitHub Dependency Graph
         if: always()
@@ -110,16 +117,17 @@ jobs:
             --platform linux/${{ matrix.arch }} \
             -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
 
+      # FIX 1: Add a step to clear the Trivy cache directory before scanning.
+      - name: Clear Trivy cache
+        run: rm -rf ${{ github.workspace }}/.cache/trivy
+
       # This scan checks the final image, including the Go standard library version.
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
         uses: aquasecurity/trivy-action@0.32.0
         # Moved 'continue-on-error' to the step level where it belongs.
         continue-on-error: true
-        # Use the 'env' block to pass environment variables to the Trivy binary.
-        env:
-          # TRIVY_RESET forces Trivy to clear all caches and download a fresh database.
-          TRIVY_RESET: 'true'
+        # FIX 1: Removed the deprecated 'TRIVY_RESET' environment variable.
         with:
           scan-type: 'image'
           image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
@@ -148,7 +156,7 @@ jobs:
           issue-number: ${{ github.event.pull_request.number }}
           body-file: 'trivy-image-comment-report.txt'
           edit-mode: replace
-          unique-id-for-comment: image-scan-${{ matrix.arch }}
+          # FIX 2: Removed the invalid 'unique-id-for-comment' input.
           
       - name: Fail job if vulnerabilities were found
         if: steps.image_scan_blocker.outcome == 'failure'

From 22331f5e2b62e22ef23f396e0bf414de082fb9f2 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 25 Aug 2025 12:20:41 +0530
Subject: [PATCH 31/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 155 +++++++++++++---------------
 1 file changed, 73 insertions(+), 82 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 689c93ae..26bb3ff9 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -1,4 +1,4 @@
-name: Security Scan
+name: Security Scan with Trivy CLI
 
 on:
   push:
@@ -11,92 +11,83 @@ on:
       - dev
 
 permissions:
-  contents: write    
+  contents: write      
   security-events: write
   pull-requests: write
 
 jobs:
   scan-fs:
     name: Scan Go Dependencies (FS)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.23.7"
+          go-version: "1.23.10"
           cache-dependency-path: go.sum
 
       - name: Download Go modules
         run: go mod download
 
-      # FIX 1: Add a step to clear the Trivy cache directory before scanning.
-      # This ensures a fresh vulnerability database is downloaded every time.
-      - name: Clear Trivy cache
-        run: rm -rf ${{ github.workspace }}/.cache/trivy
 
-      # This is the primary scan for your Go module vulnerabilities.
-      - name: 🛑 Scan for vulnerabilities (Blocker)
-        id: scan_blocker
-        uses: aquasecurity/trivy-action@0.32.0
-        # Moved 'continue-on-error' to the step level where it belongs.
+      - name: Install Trivy
+        run: |
+          # This script installs the latest version of Trivy.
+          # See https://aquasecurity.github.io/trivy/v0.53/getting-started/installation/
+          sudo apt-get install wget apt-transport-https gnupg lsb-release -y
+          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
+          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
+          sudo apt-get update
+          sudo apt-get install trivy -y
+
+      - name: 🛑 Scan filesystem for vulnerabilities (Blocker)
+        id: fs_scan_blocker
         continue-on-error: true
-        # FIX 1: Removed the deprecated 'TRIVY_RESET' environment variable.
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          skip-dirs: 'examples'
-          format: 'sarif'
-          output: 'trivy-fs-results.sarif'
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
-          exit-code: 1
-          ignore-unfixed: false
-
+        run: |
+          trivy fs \
+            --scanners vuln \
+            --dependency-tree \
+            --exit-code 1 \
+            --severity "CRITICAL,HIGH" \
+            --ignore-unfixed \
+            --skip-dirs "examples" \
+            .
+    
       - name: Generate report for PR comment
-        if: steps.scan_blocker.outcome == 'failure'
-        uses: aquasecurity/trivy-action@0.32.0
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          skip-dirs: 'examples'
-          format: 'table'
-          output: 'trivy-fs-comment-report.txt'
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
-          exit-code: 0
-          ignore-unfixed: false
-          
+        if: steps.fs_scan_blocker.outcome == 'failure'
+        run: |
+          # Run the same scan, but with exit-code 0 so it doesn't fail.
+          # Redirect the table output to a file for the PR comment.
+          trivy fs \
+            --scanners vuln \
+            --dependency-tree \
+            --exit-code 0 \
+            --severity "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN" \
+            --ignore-unfixed \
+            --format table \
+            --skip-dirs "examples" \
+            . > trivy-fs-comment-report.txt
+
       - name: Post vulnerability report on PR
-        if: steps.scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'
+        if: steps.fs_scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'
         uses: peter-evans/create-or-update-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body-file: trivy-fs-comment-report.txt
           edit-mode: replace
-          # FIX 2: Removed the invalid 'unique-id-for-comment' input.
-          # The action automatically finds and updates its own previous comments.
-
-      - name: ✅ Scan and submit to GitHub Dependency Graph
-        if: always()
-        uses: aquasecurity/trivy-action@0.32.0
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          skip-dirs: 'examples'
-          format: 'github'
-          exit-code: 0
 
       - name: Fail job if vulnerabilities were found
-        if: steps.scan_blocker.outcome == 'failure'
+        if: steps.fs_scan_blocker.outcome == 'failure'
         run: |
           echo "Failing the job due to filesystem vulnerabilities."
           exit 1
 
-  # JOB 2: Image Scan
   scan-image:
     name: Scan Docker Images
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: scan-fs
     strategy:
       fail-fast: false
@@ -104,7 +95,7 @@ jobs:
         arch: [amd64, arm64]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Set up QEMU and Docker Buildx
         uses: docker/setup-qemu-action@v3
@@ -115,39 +106,40 @@ jobs:
         run: |
           docker build --build-arg TARGETARCH=${{ matrix.arch }} \
             --platform linux/${{ matrix.arch }} \
-            -t my-app-scan:${{ github.sha }}-${{ matrix.arch }} .
+            -t newrelic-lambda-extension:${{ github.sha }}-${{ matrix.arch }} .
 
-      # FIX 1: Add a step to clear the Trivy cache directory before scanning.
-      - name: Clear Trivy cache
-        run: rm -rf ${{ github.workspace }}/.cache/trivy
+      - name: Install Trivy
+        run: |
+          sudo apt-get install wget apt-transport-https gnupg lsb-release -y
+          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
+          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
+          sudo apt-get update
+          sudo apt-get install trivy -y
 
-      # This scan checks the final image, including the Go standard library version.
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
-        uses: aquasecurity/trivy-action@0.32.0
-        # Moved 'continue-on-error' to the step level where it belongs.
         continue-on-error: true
-        # FIX 1: Removed the deprecated 'TRIVY_RESET' environment variable.
-        with:
-          scan-type: 'image'
-          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
-          format: 'sarif'
-          output: 'trivy-image-results.sarif'
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
-          exit-code: 1
-          ignore-unfixed: false
-
+        run: |
+          trivy image \
+            --scanners vuln \
+            --dependency-tree \
+            --exit-code 1 \
+            --severity "CRITICAL,HIGH" \
+            --ignore-unfixed \
+            --format table \
+            newrelic-lambda-extension:${{ github.sha }}-${{ matrix.arch }}
       - name: Generate report for PR comment
         if: steps.image_scan_blocker.outcome == 'failure'
-        uses: aquasecurity/trivy-action@0.32.0
-        with:
-          scan-type: 'image'
-          image-ref: 'my-app-scan:${{ github.sha }}-${{ matrix.arch }}'
-          format: 'table'
-          output: 'trivy-image-comment-report.txt'
-          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
-          exit-code: 0
-          ignore-unfixed: false
+        run: |
+          # Run the same scan, but with exit-code 0 and redirect output to a file.
+          trivy image \
+            --scanners vuln \
+            --dependency-tree \
+            --exit-code 0 \
+            --severity "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN" \
+            --ignore-unfixed \
+            --format table \
+            newrelic-lambda-extension:${{ github.sha }}-${{ matrix.arch }} > trivy-image-comment-report.txt
       
       - name: Post vulnerability report on PR
         if: steps.image_scan_blocker.outcome == 'failure' && github.event_name == 'pull_request'
@@ -156,8 +148,7 @@ jobs:
           issue-number: ${{ github.event.pull_request.number }}
           body-file: 'trivy-image-comment-report.txt'
           edit-mode: replace
-          # FIX 2: Removed the invalid 'unique-id-for-comment' input.
-          
+
       - name: Fail job if vulnerabilities were found
         if: steps.image_scan_blocker.outcome == 'failure'
         run: |

From 3037fdabe2b54b7610ca5e6d1fa579808e9a6d33 Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 25 Aug 2025 13:07:51 +0530
Subject: [PATCH 32/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 26bb3ff9..7d9fb85f 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   scan-fs:
     name: Scan Go Dependencies (FS)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -32,7 +32,6 @@ jobs:
       - name: Download Go modules
         run: go mod download
 
-
       - name: Install Trivy
         run: |
           # This script installs the latest version of Trivy.
@@ -45,17 +44,17 @@ jobs:
 
       - name: 🛑 Scan filesystem for vulnerabilities (Blocker)
         id: fs_scan_blocker
-        continue-on-error: true
+        continue-on-error: true 
         run: |
           trivy fs \
             --scanners vuln \
             --dependency-tree \
             --exit-code 1 \
-            --severity "CRITICAL,HIGH" \
+            --severity "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN" \
             --ignore-unfixed \
             --skip-dirs "examples" \
             .
-    
+
       - name: Generate report for PR comment
         if: steps.fs_scan_blocker.outcome == 'failure'
         run: |
@@ -118,16 +117,17 @@ jobs:
 
       - name: 🛑 Scan image for vulnerabilities (Blocker)
         id: image_scan_blocker
-        continue-on-error: true
+        continue-on-error: true 
         run: |
           trivy image \
             --scanners vuln \
             --dependency-tree \
             --exit-code 1 \
-            --severity "CRITICAL,HIGH" \
+            --severity "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN" \
             --ignore-unfixed \
             --format table \
             newrelic-lambda-extension:${{ github.sha }}-${{ matrix.arch }}
+
       - name: Generate report for PR comment
         if: steps.image_scan_blocker.outcome == 'failure'
         run: |

From 3e648e9327abd2b6a198688114e00fee0d52239c Mon Sep 17 00:00:00 2001
From: Chodavarapu Naga Viswanadha Avinash <aavinash@newrelic.com>
Date: Mon, 25 Aug 2025 13:58:48 +0530
Subject: [PATCH 33/33] Update security-scan.yml

---
 .github/workflows/security-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 7d9fb85f..67f5f460 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.23.10"
+          go-version: "1.23.7"
           cache-dependency-path: go.sum
 
       - name: Download Go modules