Container security (#32)

* feat: container vulnerability scanning

* fix: Skip safety for dependabot

.github/workflows/docker.yaml

@@ -133,6 +133,7 @@ jobs:
           exit-code: "1"
           format: "table"
           cache-dir: .trivy-cache
+          trivyignores: ".trivyignore"
 
       - name: Scan for MEDIUM/LOW vulnerabilities (warning only)
         uses: aquasecurity/trivy-action@0.33.1
@@ -142,6 +143,7 @@ jobs:
           exit-code: "0"
           format: "table"
           cache-dir: .trivy-cache
+          trivyignores: ".trivyignore"
         continue-on-error: true
 
       - name: Generate SARIF report for GitHub Security
@@ -152,6 +154,7 @@ jobs:
           format: "sarif"
           output: "trivy-results.sarif"
           cache-dir: .trivy-cache
+          trivyignores: ".trivyignore"
         continue-on-error: true
 
       - name: Upload Trivy scan results

.github/workflows/pre-commit.yaml

@@ -47,9 +47,12 @@ jobs:
           # Skip hooks that don't work well in CI:
           # - no-commit-to-branch: Always fails in CI (we're on main/master)
           # - trufflehog: Has wasm/go-re2 panic bug in GitHub Actions environment
+          # - safety: Skipped if SAFETY_API_KEY secret is not configured
           # Note: shellcheck, hadolint, trivy use mise-managed binaries which ARE
           # installed by mise-action above, so they should work in CI.
-          SKIP: no-commit-to-branch,trufflehog
+          SKIP: no-commit-to-branch,trufflehog${{ secrets.SAFETY_API_KEY == '' && ',safety' || '' }}
           # Safety CLI API key for dependency vulnerability scanning
+          # Get your key at: https://safetycli.com/ (free account)
+          # Add as repository secret: Settings → Secrets → Actions → SAFETY_API_KEY
           SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
         run: uv run pre-commit run --all-files --show-diff-on-failure