CI improvements from LXD

[simondeziel]

No description provided.

[Copilot]

Pull request overview

Updates GitHub Actions CI workflows to improve security posture (credential persistence, action pinning signals) and enhance vulnerability scanning (Trivy SARIF + KEV tagging), based on patterns from LXD.

Changes:

• Disable persisted git credentials on actions/checkout across multiple workflows/jobs.
• Rework Trivy security scanning to use aquasecurity/trivy-action, upload SARIF, and tag KEV-listed CVEs.
• Pin the documentation reusable workflow by commit and add zizmor ignore annotations for specific findings.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/triage.yml	Adds zizmor suppression for pull_request_target trigger warning.
.github/workflows/tests.yml	Disables checkout credential persistence in jobs; pins doc workflow by commit; adds zizmor suppression for an unpinned reusable action.
.github/workflows/security.yml	Migrates Trivy scanning to aquasecurity/trivy-action, adds KEV tagging logic, and adjusts permissions/conditions.
.github/workflows/codeql.yml	Disables checkout credential persistence for CodeQL job.
.github/actions/system-test/action.yml	Adds checkout credential hardening and zizmor suppressions; refactors input usage in bash steps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This workflow runs canonical/lxd/.github/actions/lp-snap-build@main while providing an SSH private key secret. Using an unpinned ref (@main) for an external action is a supply-chain risk because the referenced code can change without review. Prefer pinning to an immutable commit SHA (or a trusted, immutable tag) instead of suppressing the warning.

Suggested change

	- uses: canonical/lxd/.github/actions/lp-snap-build@main # zizmor: ignore[unpinned-uses]
	- uses: canonical/lxd/.github/actions/lp-snap-build@FULL_40_CHARACTER_COMMIT_SHA # pin to the reviewed action revision

[simondeziel]

LXD's main moves too fast for pinning IMHO. Considering that dependabot has cooldowns and grouped updates, maybe @roosterfish will opt for pinning anyway though.

[Copilot]

These steps reference reusable actions from canonical/lxd using the mutable @main ref. Even though this is within the same org, it still weakens supply-chain integrity and makes builds non-reproducible. Prefer pinning each uses: to a specific commit SHA (or an immutable tag) rather than adding zizmor ignores.

[simondeziel]

Same here. Up to @roosterfish