refactor: switch Trivy output from table to JSON format

Structured JSON gives Claude direct access to fields like VulnerabilityID,
PkgName, Severity, FixedVersion instead of parsing a text table. Also
renders a proper markdown table in the Trivy scan summary step.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: msukkari

.github/workflows/trivy-vulnerability-triage.yml

@@ -51,25 +51,26 @@ jobs:
         uses: aquasecurity/trivy-action@master
         with:
           image-ref: "${{ env.IMAGE }}:${{ inputs.image_tag || 'latest' }}"
-          format: "table"
-          output: "trivy-results.txt"
+          format: "json"
+          output: "trivy-results.json"
           trivy-config: trivy.yaml
- 
+
       - name: Check for vulnerabilities
         id: check
         run: |
-          if [ -s trivy-results.txt ] && grep -qE "Total: [1-9]" trivy-results.txt; then
+          VULN_COUNT=$(jq '[.Results[]? | .Vulnerabilities[]?] | length' trivy-results.json)
+          if [ "$VULN_COUNT" -gt 0 ]; then
             echo "has_vulnerabilities=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_vulnerabilities=false" >> "$GITHUB_OUTPUT"
           fi
- 
+
       - name: Upload scan results
         if: steps.check.outputs.has_vulnerabilities == 'true' || inputs.force_analysis == true
         uses: actions/upload-artifact@v4
         with:
           name: trivy-results
-          path: trivy-results.txt
+          path: trivy-results.json
           retention-days: 30
 
       - name: Write Trivy summary
@@ -79,15 +80,15 @@ jobs:
           echo "**Image:** \`${{ env.IMAGE }}:${{ inputs.image_tag || 'latest' }}\`" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
           if [ "${{ steps.check.outputs.has_vulnerabilities }}" = "true" ]; then
-            echo "Vulnerabilities detected. Results uploaded as artifact." >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo "<details><summary>Trivy output</summary>" >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo '```' >> "$GITHUB_STEP_SUMMARY"
-            cat trivy-results.txt >> "$GITHUB_STEP_SUMMARY"
-            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            VULN_COUNT=$(jq '[.Results[]? | .Vulnerabilities[]?] | length' trivy-results.json)
+            CRIT_COUNT=$(jq '[.Results[]? | .Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' trivy-results.json)
+            HIGH_COUNT=$(jq '[.Results[]? | .Vulnerabilities[]? | select(.Severity == "HIGH")] | length' trivy-results.json)
+            MED_COUNT=$(jq '[.Results[]? | .Vulnerabilities[]? | select(.Severity == "MEDIUM")] | length' trivy-results.json)
+            echo "**$VULN_COUNT** vulnerabilities found: **$CRIT_COUNT** critical, **$HIGH_COUNT** high, **$MED_COUNT** medium." >> "$GITHUB_STEP_SUMMARY"
             echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo "</details>" >> "$GITHUB_STEP_SUMMARY"
+            echo "| CVE ID | Severity | Package | Installed | Fixed |" >> "$GITHUB_STEP_SUMMARY"
+            echo "|--------|----------|---------|-----------|-------|" >> "$GITHUB_STEP_SUMMARY"
+            jq -r '[.Results[]? | .Vulnerabilities[]?] | sort_by(.Severity) | .[] | "| \(.VulnerabilityID) | \(.Severity) | \(.PkgName) | \(.InstalledVersion) | \(.FixedVersion // "N/A") |"' trivy-results.json >> "$GITHUB_STEP_SUMMARY"
           else
             echo "No vulnerabilities found." >> "$GITHUB_STEP_SUMMARY"
           fi
@@ -219,8 +220,8 @@ jobs:
 
       - name: Ensure Trivy results file exists
         run: |
-          if [ ! -f trivy-results.txt ]; then
-            echo "No Trivy vulnerabilities found." > trivy-results.txt
+          if [ ! -f trivy-results.json ]; then
+            echo '{"Results":[]}' > trivy-results.json
           fi
 
       - name: Fetch Dependabot alerts
@@ -389,7 +390,7 @@ jobs:
             You are a security engineer triaging vulnerabilities and security findings for the Sourcebot Docker image.
             You have three data sources to analyze:
 
-            1. **Trivy scan results** in `trivy-results.txt` — container image vulnerability scan
+            1. **Trivy scan results** in `trivy-results.json` — container image vulnerability scan (JSON format with `Results[].Vulnerabilities[]` array)
             2. **Dependabot alerts** in `dependabot-alerts.json` — GitHub dependency vulnerability alerts
             3. **CodeQL alerts** in `codeql-alerts.json` — GitHub code scanning findings