[jmclong (jmclong)]

Summary

• Scan rendered CSI sidecar images on linux/amd64 only; driver and manager scans already use amd64.
• Remove the ECR-only vulnerability database override, using the default Google mirror with GHCR fallback.
• Upload SARIF reports for the driver, manager, and all three sidecars on main and pull requests, using distinct analysis categories.
• Use report-only vulnerability scans, matching the DACS reporting pattern without its separate critical-vulnerability blocking step.
• Preserve ignore-unfixed filtering. Vulnerability findings, including critical findings, do not fail scan jobs; scanner and upload errors still fail.
• Update the chart README. CodeQL and DevSkim workflows are unchanged.

Reason

Run 40670127144 failed downloading the vulnerability database from public ECR with TOOMANYREQUESTS: Data limit exceeded. Default mirrors avoid forcing every scan through that single registry. SARIF uploads make findings available for triage in GitHub Security instead of failing scan jobs for the existing vulnerability backlog.

Validation

• All commit-time pre-commit hooks passed, including actionlint, zizmor, Markdown/link checks, and Helm validation.
• A fresh database download with Trivy 0.70.0, matching the pinned action default, succeeded from mirror.gcr.io/aquasec/trivy-db:2.
• A report-only scan of alpine:3.18.0 generated SARIF 2.1.0 with 49 findings, including one critical finding, and exited successfully.
• A missing-database test confirmed scanner initialization errors still fail with exit-code set to 0.
• git diff --check passed.
• Go builds and unit tests were not run because only workflow configuration and documentation changed. GitHub SARIF ingestion requires the hosted CI run.

Coverage

ARM64 sidecar images are intentionally no longer scanned by this workflow. Architecture build and test workflows are unchanged. This PR adds no vulnerability-severity gate and does not alter repository branch-protection or code-scanning rules.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Hari (hasethuraman)]

FYI jmclong (@jmclong) After PR #686:
Scans still run and still find the same vulnerabilities.
They write SARIF and upload it with github/codeql-action/upload-sarif.
exit-code is set to 0, so the job succeeds even when critical findings exist.
Those findings become code scanning alerts instead of failing the build.