Security hardening: dependency + IaC remediation with CI scan gate#250

Open

devin-ai-integration[bot] wants to merge 6 commits into

devin/1781641221-security-hardening

Commits on Jun 16, 2026

feature: security hardening - dependency + IaC remediation with CI scan gate

devin-ai-integration[bot]
and
achalc
committed
bug: pin trivy-action to valid released tag (v0.29.0 SHA)

devin-ai-integration[bot]
and
achalc
committed
bug: pin trivy-action to v0.36.0 (setup-trivy ref exists; v0.29.0 referenced deleted setup-trivy@v0.2.2)

devin-ai-integration[bot]
and
achalc
committed
bug: make mvnw executable in CI before build (committed as non-exec, caused exit 126)

devin-ai-integration[bot]
and
achalc
committed
feature: add .snyk policy documenting accepted GPL-2.0 license for required MySQL JDBC driver

devin-ai-integration[bot]
and
achalc
committed
feature: harden Helm chart workloads (securityContext, readonly rootfs) to clear Trivy IaC gate

devin-ai-integration[bot]
and
achalc
committed