feat(security): replace Trivy with Google OSV Scanner

[CommanderK5]

Summary

Replaces Aqua Security Trivy with Google OSV Scanner for vulnerability scanning.

Why

Trivy is being replaced with Google OSV Scanner to align with the tooling direction across Coder repos. OSV Scanner provides both source dependency scanning and container image scanning, with reachability analysis (--call-analysis=all) to reduce false positives by checking if vulnerable functions are actually called.

Reference: https://github.com/coder/tallyman/commit/7ccfac0630bf873b2f5e9bc045a795e1ddfa7477

How

Replaced the Trivy steps in the build job with four new jobs:

Job	Purpose	Trigger
osv-scan-scheduled	Full source dependency scan via official reusable workflow	push, schedule, dispatch
osv-scan-pr	Diff-only scan (only new vulns) via official reusable workflow	pull_request
osv-scan-alert	Slack notification for source scan failures	schedule (on failure)
osv-scan-image	Container image scan via osv-scanner scan image CLI	all triggers

Key details:

• Source scanning uses the reusable workflows as recommended by the OSV Scanner docs
• Image scanning installs the CLI binary (v2.3.5) with SHA256 checksum verification
• Exit code handling tolerates code 1 (vulns found) but fails on real errors
• Added schedule trigger (weekdays) for recurring vulnerability scans
• The build job is now a pure build verification; image scanning is a separate job

Note

Generated by Coder Agents

[johnstcn]

Needs to be replaced with osv-scanner

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.