From 7c6217653d1e494f29a03b0ee2146de17b46a5f5 Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:39:58 -0300
Subject: [PATCH] chore: add actions-nullplatform compliance workflows + trivy

Add conventional-commit, release, branch-validation, shellcheck and trivy
reusable workflows. Make trivy pass: enable ECR scan_on_push (AVD-AWS-0030 fix);
suppress AVD-AWS-0031 (placeholder repo uses mutable latest tags by design) and
AVD-DS-0002 (placeholder images: http-echo + Lambda base) via .trivyignore.
---
 .github/workflows/branch-validation.yml   | 10 ++++++++++
 .github/workflows/conventional-commit.yml | 10 ++++++++++
 .github/workflows/release.yml             | 15 +++++++++++++++
 .github/workflows/shellcheck.yml          | 10 ++++++++++
 .github/workflows/trivy.yml               | 14 ++++++++++++++
 .trivyignore                              | 10 ++++++++++
 lambda/specs/requirements/main.tf         |  2 +-
 7 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/branch-validation.yml
 create mode 100644 .github/workflows/conventional-commit.yml
 create mode 100644 .github/workflows/release.yml
 create mode 100644 .github/workflows/shellcheck.yml
 create mode 100644 .github/workflows/trivy.yml
 create mode 100644 .trivyignore

diff --git a/.github/workflows/branch-validation.yml b/.github/workflows/branch-validation.yml
new file mode 100644
index 0000000..6d75b77
--- /dev/null
+++ b/.github/workflows/branch-validation.yml
@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
new file mode 100644
index 0000000..92952e1
--- /dev/null
+++ b/.github/workflows/conventional-commit.yml
@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8a65e73
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..abf7bd9
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
new file mode 100644
index 0000000..1a3c210
--- /dev/null
+++ b/.github/workflows/trivy.yml
@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..da9ee64
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,10 @@
+# Trivy misconfiguration suppressions for this repo (intentional, documented).
+
+# AVD-DS-0002 — placeholder container images run as-is: the root http-echo
+# placeholder and the Lambda base image (public.ecr.aws/lambda/nodejs) manage the
+# runtime user themselves; a USER directive is not applicable.
+AVD-DS-0002
+
+# AVD-AWS-0031 — the placeholder ECR repo uses mutable 'latest-<arch>' tags by
+# design (a mirrored placeholder image, overwritten in place).
+AVD-AWS-0031
diff --git a/lambda/specs/requirements/main.tf b/lambda/specs/requirements/main.tf
index 402fc29..286f13a 100644
--- a/lambda/specs/requirements/main.tf
+++ b/lambda/specs/requirements/main.tf
@@ -352,7 +352,7 @@ resource "aws_ecr_repository" "lambda_placeholder" {
   image_tag_mutability = "MUTABLE"
 
   image_scanning_configuration {
-    scan_on_push = false
+    scan_on_push = true
   }
 
   tags = local.iam_default_tags