Fix failing Trivy (Go SDK) check: bump x/text + split scan from gate

[jeremy]

What happened

The `Trivy (Go SDK)` check went red on #369/#370 on 2026-07-15 (main last passed 2026-07-14). This was not a trivy 0.69.1 vs 0.70.0 scanner/DB discrepancy, and not a HIGH/CRITICAL advisory:

• Finding: CVE-2026-56852 — `golang.org/x/text` v0.32.0 (indirect dep), infinite loop in `norm.Iter` on invalid UTF-8. Fixed in v0.39.0. Severity: UNKNOWN.
• Mechanism: trivy-action in SARIF mode ignores the `severity: HIGH,CRITICAL` input unless `limit-severities-for-sarif: true` is set (log line: "Building SARIF report with all severities"). `exit-code: '1'` then fires on any fixable finding of any severity. The CVE entered the vulnerability DB between main's July 14 run and the PRs' July 15 runs.
• Local 0.69.1 appeared "clean" only because table format applies the severity filter — the scanner version was irrelevant.
• Dependabot's 3 open alerts are npm/pip (vitest, esbuild, Pygments) — unrelated. `govulncheck` passes.
• Note: Trivy jobs are not in the main ruleset's required checks — BC5 OAuth Ask #1: resource-first discovery (5 SDKs) #369/BC5 OAuth: device flow (RFC 8628, 5 SDKs) #370 were UNSTABLE, not merge-blocked. This is CI hygiene.

Changes

Commit 1 — bump `golang.org/x/text` to v0.39.0 (`go/go.mod`, `go/go.sum`). Sibling indirect x/* modules bump alongside via `go mod tidy`. Fixes today's finding at the root.

Commit 2 — restructure all 3 Trivy jobs into scan + gate:

1. SARIF scan, no exit code — full-severity results stay visible in the Security tab.
2. Upload SARIF (unchanged, `if: always()`; gate runs after upload so a gate failure never loses the SARIF).
3. Gate: table format, `severity: HIGH,CRITICAL`, `exit-code: '1'` — table mode passes the severity filter through, so enforcement finally matches the declared policy. Reuses the first step's trivy install and DB (`skip-setup-trivy: true`, `cache: 'false'`, `TRIVY_SKIP_DB_UPDATE: true`).

Policy change (deliberate narrowing): the gate now enforces HIGH/CRITICAL severity for both vulnerability and secret findings. Previously, SARIF mode's severity-filter bypass meant the job failed on any severity — including LOW/MEDIUM secret rules (Stripe publishable keys, Slack webhooks, Twilio keys). LOW/MEDIUM findings remain visible in SARIF but no longer fail the Trivy job; Gitleaks remains the primary repo-wide secret gate.

Verification

• `make lint-actions` (actionlint + zizmor) and full `make check` pass locally.
• Local repro with trivy 0.70.0 (checksum-verified release binary, same as CI): pre-fix, the CI invocation exits 1 with the x/text finding; post-bump, exits 0.

Rollout to the OAuth stack

A bare rerun of #370 does not pick up this fix. After merge:

1. If BC5 OAuth Ask #1: resource-first discovery (5 SDKs) #369 remains open: update `oauth-discovery-transition` from `main`; verify BC5 OAuth Ask #1: resource-first discovery (5 SDKs) #369's Trivy check.
2. That base-branch update propagates into BC5 OAuth: device flow (RFC 8628, 5 SDKs) #370; rerun BC5 OAuth: device flow (RFC 8628, 5 SDKs) #370's checks if GitHub doesn't auto-synchronize.
3. If BC5 OAuth Ask #1: resource-first discovery (5 SDKs) #369 merges first: retarget/rebase BC5 OAuth: device flow (RFC 8628, 5 SDKs) #370 onto `main`.

---

Summary by cubic

Fixes the failing Trivy (Go SDK) check by upgrading golang.org/x/text to v0.39.0 and separating Trivy scans from the enforcement gate. The gate now enforces only HIGH and CRITICAL while keeping full SARIF results visible.

• Bug Fixes

  • Split Trivy jobs (Go, TypeScript, Ruby) into a full-severity SARIF scan (no exit) and a table-format gate with severity: HIGH,CRITICAL and exit-code: '1' (reuses DB via TRIVY_SKIP_DB_UPDATE, skip-setup-trivy, cache: 'false').
  • LOW/MEDIUM findings no longer fail the job; they remain in SARIF.

• Dependencies

  • Upgrade golang.org/x/text to v0.39.0 to address CVE-2026-56852; indirect golang.org/x/* modules updated via go mod tidy.

^{Written for commit 28023b3. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/security.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

This PR fixes a newly surfaced Trivy finding in the Go SDK by updating the affected indirect Go dependency, and adjusts the Security workflow so Trivy results remain visible in GitHub code scanning (SARIF) while enforcement is applied separately using a severity-gated scan.

Changes:

• Bump golang.org/x/text (and related indirect golang.org/x/* modules via tidy) to versions that address the reported CVE.
• Split each Trivy job into (1) full-severity SARIF scan + (2) SARIF upload + (3) a separate HIGH/CRITICAL “gate” scan that can fail the job.
• Apply the same scan+gate structure consistently across Go, TypeScript, and Ruby Trivy jobs.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
go/go.mod	Updates indirect golang.org/x/* module versions, including x/text to address the Trivy finding.
go/go.sum	Records the new resolved module versions and checksums from the dependency update.
.github/workflows/security.yml	Restructures Trivy jobs into SARIF scan + upload + HIGH/CRITICAL gate to align enforcement with the intended severity policy while preserving full visibility.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.