Chore: [AEA-0000] - move to new qc

[anthony-nhs]

Summary

• Routine Change

Details

• move to latest qc
• remove all trivy files
• add CODEOWNERS to restrict updates to workflows
• use least permissions on all workflows
• add --ignore-scripts true to npm install

[Copilot]

Pull request overview

Routine QC/tooling migration PR that updates the repo’s security/quality tooling configuration and aligns GitHub Actions workflows/devcontainer with the new baseline.

Changes:

• Replace Trivy ignore/config with Grype + add local pre-commit scanning support.
• Update GitHub Actions workflows to newer eps-common-workflows SHAs, add CODEOWNERS protection for workflow changes, and adjust workflow security settings.
• Bump devcontainer image version and add supporting config (zizmor + gitignore).

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
zizmor.yml	Adds zizmor rule ignore configuration.
.pre-commit-config.yaml	Adds a local grype-scan-local pre-commit hook.
.grype.yaml	Adds Grype vulnerability ignore configuration.
.gitignore	Ignores generated SBOM directory.
.github/workflows/sync_copilot.yml	Updates workflow default permissions configuration.
.github/workflows/ci.yml	Updates reusable workflow SHAs and sets workflow permissions.
.github/workflows/release.yml	Updates reusable workflow SHAs and sets workflow permissions.
.github/workflows/pull_request.yml	Updates reusable workflow SHAs and sets workflow permissions.
.github/workflows/package_npm_code.yml	Sets workflow permissions and adjusts checkout behavior.
.github/CODEOWNERS	Requires EPS admins to review workflow changes.
.devcontainer/devcontainer.json	Bumps devcontainer image version.
trivy.yaml	Removed as part of the move away from Trivy config.
.trivyignore.yaml	Removed Trivy vulnerability ignore list.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

This fallback assumes listPullRequestsAssociatedWithCommit(...).data[0] always exists; if no PR is associated with the commit, this will throw. Since this workflow only runs on pull_request, context.issue.number should already be present—consider removing the fallback branch entirely (or guard against an empty .data result if you intend this script to be reusable for other events).

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 2 comments.

[Copilot]

npm ci --ignore-scripts true passes an extra positional argument (true) to npm ci, which can cause the command to fail or behave unexpectedly. Use the boolean flag form (npm ci --ignore-scripts) or the explicit assignment form (--ignore-scripts=true) so the install reliably runs with scripts disabled.

Suggested change

	npm ci --ignore-scripts true
	npm ci --ignore-scripts

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud