ci: fix trivy-action ref (@master, 0.24.0 doesn't exist) + rewrite ci.yml

ci.yml was failing at workflow-validation (0s) for many runs; rewrite with an explicit
dtolnay/rust-toolchain (rustfmt+clippy) and plain step names. image.yml's trivy step used a
non-existent action tag, failing the release job at setup before the image built.

Author: RoyLin

.github/workflows/ci.yml

@@ -9,17 +9,17 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+# Host-buildable parts only: the contracts lib + shared types + parsers. The eBPF crate +
+# collector need nightly + bpf-linker (a self-hosted BPF runner) and are not built here.
 jobs:
-  # Host-buildable parts: the contracts lib + shared types + parsers. The eBPF crate +
-  # collector need nightly + bpf-linker (a self-hosted BPF runner) and are not built here.
   lib:
-    name: lib + parsers (fmt, clippy, test)
+    name: lib + parsers
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: rustfmt (whole workspace — parse-only, no build)
-        run: cargo fmt --all -- --check
-      - name: clippy (host-buildable crates)
-        run: cargo clippy -p a3s-observer -p a3s-observer-common -- -D warnings
-      - name: test (contracts lib + common: SNI / ppid / cgroup parsers)
-        run: cargo test -p a3s-observer -p a3s-observer-common
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy -p a3s-observer -p a3s-observer-common -- -D warnings
+      - run: cargo test -p a3s-observer -p a3s-observer-common

.github/workflows/image.yml

@@ -52,7 +52,7 @@ jobs:
           sbom: true # SBOM attestation
       # Supply chain: scan for fixable CRITICAL CVEs, then keyless-sign the pushed digest.
       - name: Trivy image scan (report fixable CRITICAL/HIGH)
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@master # TODO: pin to a release SHA once chosen
         with:
           image-ref: ${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}
           severity: CRITICAL,HIGH