ci: bump trivy-action 0.24.0 -> 0.30.0 (was an invalid version) #2

	name: ci

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read
	security-events: write

	jobs:
	lint-test:
	name: lint + test
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-go@v5
	with:
	go-version: "1.22"
	cache: true

	- name: go vet
	run: go vet ./...

	- name: golangci-lint
	uses: golangci/golangci-lint-action@v6
	with:
	version: v1.59

	- name: go test
	run: go test -race -count=1 ./...

	build-scan:
	name: build + trivy
	runs-on: ubuntu-latest
	needs: lint-test
	steps:
	- uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Build image (load locally)
	uses: docker/build-push-action@v6
	with:
	context: .
	load: true
	tags: devsecops-warmup:ci

	- name: Trivy filesystem scan
	uses: aquasecurity/trivy-action@0.30.0
	with:
	scan-type: fs
	scan-ref: .
	severity: CRITICAL,HIGH
	exit-code: "1"
	ignore-unfixed: true

	- name: Trivy image scan
	uses: aquasecurity/trivy-action@0.30.0
	with:
	image-ref: devsecops-warmup:ci
	severity: CRITICAL,HIGH
	exit-code: "1"
	ignore-unfixed: true

	- name: Trivy SARIF (for code scanning)
	if: always()
	uses: aquasecurity/trivy-action@0.30.0
	with:
	image-ref: devsecops-warmup:ci
	format: sarif
	output: trivy-results.sarif
	severity: CRITICAL,HIGH
	ignore-unfixed: true

	- name: Upload SARIF
	if: always()
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: trivy-results.sarif

Provide feedback