From 9b66cb465efdbb79e843530b9c861d04788595b9 Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Wed, 2 Sep 2026 09:49:57 +0000
Subject: [PATCH] [patch] Remove Trivy image scanning

---
 .github/workflows/lint-test-build.yml | 11 -----------
 ci/workflow_contract_test.go          |  1 -
 2 files changed, 12 deletions(-)

diff --git a/.github/workflows/lint-test-build.yml b/.github/workflows/lint-test-build.yml
index d11b3dc..6a3a043 100644
--- a/.github/workflows/lint-test-build.yml
+++ b/.github/workflows/lint-test-build.yml
@@ -82,16 +82,6 @@ jobs:
           push: false
           tags: lightsout:ci-${{ matrix.architecture.suffix }}
 
-      - name: Scan native image
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          image-ref: lightsout:ci-${{ matrix.architecture.suffix }}
-          format: table
-          exit-code: "1"
-          ignore-unfixed: true
-          severity: HIGH,CRITICAL
-          vuln-type: os,library
-
   run:
     name: run
     if: ${{ always() && github.event_name == 'pull_request' }}
@@ -108,7 +98,6 @@ jobs:
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
-      scan: true
       sign: true
       certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@8e27d95846671a9e319f1900e86a488a1d4f39b3
     permissions:
diff --git a/ci/workflow_contract_test.go b/ci/workflow_contract_test.go
index b905b16..49cba08 100644
--- a/ci/workflow_contract_test.go
+++ b/ci/workflow_contract_test.go
@@ -25,7 +25,6 @@ func TestImagePublicationWorkflowContract(t *testing.T) {
 		"libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"ref: ${{ github.sha }}",
 		"expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}",
-		"scan: true",
 		"sign: true",
 		"certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"packages: write",