ci: fix wiring bugs in security scanning workflows

First real Actions run surfaced four plumbing bugs (no real findings):

- trivy-action pinned to a non-existent tag; the action's tags are
  v-prefixed (0.31.0 -> v0.31.0). Affected security, docker-publish and
  build-agent workflows.
- govulncheck wrapper invoked via `go run` on a path in the separate
  .github module, which failed to resolve against the scanned module.
  Build the wrapper binary from its own module first, then pipe into it.
- CodeQL uploaded SARIF twice per job (analyze + a manual filter step)
  with a colliding category. Drop the redundant upload; code scanning
  surfaces new-only alerts on PRs natively.
- Semgrep baseline fetch failed (exit 128) on dubious-ownership/shallow
  checkout. Use fetch-depth 0, mark the workspace safe, and diff against
  the PR base SHA instead of origin/master.

Author: otavio

.github/workflows/build-agent.yml

@@ -62,7 +62,7 @@ jobs:
             .
 
       - name: Scan amd64 agent image with Trivy
-        uses: aquasecurity/trivy-action@0.31.0
+        uses: aquasecurity/trivy-action@v0.31.0
         with:
           image-ref: shellhubio/agent:scan-amd64
           format: table

.github/workflows/codeql.yml

@@ -89,14 +89,6 @@ jobs:
           upload: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
           output: codeql-results-${{ matrix.module == '.' && 'root' || matrix.module }}.sarif
 
-      - name: Filter NEW alerts only (PR)
-        if: ${{ github.event_name == 'pull_request' }}
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: codeql-results-${{ matrix.module == '.' && 'root' || matrix.module }}.sarif
-          category: codeql-go-${{ matrix.module == '.' && 'root' || matrix.module }}
-          wait-for-processing: true
-
   # security-gate aggregates all CodeQL jobs for branch protection.
   security-gate:
     name: security-gate

.github/workflows/docker-publish.yml

@@ -116,7 +116,7 @@ jobs:
       # .trivyignore is always at shellhub/.trivyignore because all sources
       # are checked out under the shellhub/ subdirectory.
       - name: Scan '${{ matrix.project }}' image with Trivy
-        uses: aquasecurity/trivy-action@0.31.0
+        uses: aquasecurity/trivy-action@v0.31.0
         with:
           image-ref: ${{ steps.image.outputs.name }}:${{ env.RELEASE_VERSION }}
           format: table

.github/workflows/security.yml

@@ -59,12 +59,15 @@ jobs:
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
 
+      - name: Build govulncheck wrapper
+        run: |
+          ( cd "$GITHUB_WORKSPACE/.github" && go build -o "$RUNNER_TEMP/govulncheck-filter" ./govulncheck/cmd )
+
       - name: Run govulncheck
         run: |
           cd "${{ matrix.module }}"
           govulncheck -json ${{ matrix.extra_args }} ./... | \
-            go run "$GITHUB_WORKSPACE/.github/govulncheck/cmd/" \
-              "$GITHUB_WORKSPACE/.govulncheck-allow.txt"
+            "$RUNNER_TEMP/govulncheck-filter" "$GITHUB_WORKSPACE/.govulncheck-allow.txt"
 
   trivy-image:
     name: trivy-image (${{ matrix.image }})
@@ -94,7 +97,7 @@ jobs:
           load: true
 
       - name: Scan ${{ matrix.image }} image with Trivy
-        uses: aquasecurity/trivy-action@0.31.0
+        uses: aquasecurity/trivy-action@v0.31.0
         with:
           image-ref: shellhub/${{ matrix.image }}:scan
           format: table
@@ -105,7 +108,7 @@ jobs:
 
       - name: Scan ${{ matrix.image }} image with Trivy (SARIF)
         if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
-        uses: aquasecurity/trivy-action@0.31.0
+        uses: aquasecurity/trivy-action@v0.31.0
         with:
           image-ref: shellhub/${{ matrix.image }}:scan
           format: sarif

.github/workflows/semgrep.yml

@@ -34,9 +34,8 @@ jobs:
           # Full history required for --baseline-ref diff
           fetch-depth: 0
 
-      - name: Fetch master for baseline comparison
-        if: ${{ github.event_name == 'pull_request' }}
-        run: git fetch origin master
+      - name: Mark workspace safe for git (semgrep container runs as different user)
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - name: Run Semgrep (PR — baseline diff)
         if: ${{ github.event_name == 'pull_request' }}
@@ -45,7 +44,7 @@ jobs:
             --config p/golang \
             --config p/dockerfile \
             --config p/ci \
-            --baseline-ref origin/master \
+            --baseline-ref ${{ github.event.pull_request.base.sha }} \
             --error \
             --sarif \
             --output semgrep.sarif \