chore: actions-nullplatform compliance workflows + trivy

.github/workflows/branch-validation.yml

@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main

.github/workflows/conventional-commit.yml

@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main

.github/workflows/release.yml

@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit

.github/workflows/shellcheck.yml

@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main

.github/workflows/trivy.yml

@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main

.trivyignore

@@ -0,0 +1,10 @@
+# Trivy misconfiguration suppressions for this repo (intentional, documented).
+
+# AVD-DS-0002 — placeholder container images run as-is: the root http-echo
+# placeholder and the Lambda base image (public.ecr.aws/lambda/nodejs) manage the
+# runtime user themselves; a USER directive is not applicable.
+AVD-DS-0002
+
+# AVD-AWS-0031 — the placeholder ECR repo uses mutable 'latest-<arch>' tags by
+# design (a mirrored placeholder image, overwritten in place).
+AVD-AWS-0031

lambda/specs/requirements/main.tf

@@ -352,7 +352,7 @@ resource "aws_ecr_repository" "lambda_placeholder" {
   image_tag_mutability = "MUTABLE"
 
   image_scanning_configuration {
-    scan_on_push = false
+    scan_on_push = true
   }
 
   tags = local.iam_default_tags