Add Trivy and/or Grype scanning

[vredchenko]

trivy-workspace-scan-report.txt
grype-workspace-scan-report.txt

Research and evaluate:

• https://github.com/aquasecurity/trivy
• https://github.com/anchore/grype

compare and add one or both as:

• Github CI security scans against container images and repositories
• optional local dev dependencies in smartem-workspace tool,
• wrappers in scripts if useful
• expose as skills to Claude Code

[vredchenko]

Trivy vs Grype: Evaluation Summary

At a Glance

	Trivy	Grype
Scope	Swiss army knife: vulns + IaC + secrets + licenses + K8s	Single-purpose: vulnerability scanning only
DB sources	30+ sources, does NOT use NVD as primary (uses vendor advisories)	~12 sources, uses NVD as primary + GHSA
Risk scoring	Severity only (LOW/MED/HIGH/CRIT)	Composite: CVSS + EPSS + KEV = actionable risk score
False positives	Historically more, no public quality benchmarks	80% reduction recently; CI-gated with F1 score via Yardstick
Community	32k stars, default scanner in Harbor/CNCF	12k stars, smaller but focused
License	Apache 2.0 (Aqua Security)	Apache 2.0 (Anchore)
GH Actions	aquasecurity/trivy-action	anchore/scan-action

Workspace Scan Report Analysis

Trivy found 47 unique vulns across the workspace, reported per-lockfile with severity categories (HIGH/CRITICAL/etc). Clean tabular output grouped by target.

Grype found 97 entries (including duplicates from shared deps across repos), but crucially adds EPSS percentile and a composite risk score (0-10). This lets you immediately see that e.g. setuptools CVE has 6.5% EPSS (90th percentile, risk 5.3) while most npm findings have <0.1% EPSS (risk <0.1) — so you know what actually matters.

Grype also caught things Trivy missed (vite vulns, Go stdlib vulns, GitHub Action vulns) and vice versa — consistent with the known ~60% overlap between scanners.

Verdict: Use Both

The marginal cost is minimal (both are single Go binaries with GH Actions):

1. Trivy as primary CI scanner — covers vulns + IaC misconfiguration in K8s manifests + secrets scanning in one pass
2. Grype as secondary — its EPSS/KEV risk scoring is genuinely better for prioritisation, which matters when a small team can't triage everything
3. Scanning scripts already exist in scripts/ — wrapping both is straightforward

For a research facility team, Grype's risk score is the killer feature: it turns "you have 47 HIGH vulns" into "2 of these are actually being exploited in the wild, fix those first."