Normalize the trivy-action version comment to the v-prefixed tag

[jeremy]

This unblocks the GitHub Actions audit failure on #63.

aquasecurity/trivy-action published both 0.35.0 and v0.35.0 for that release, so our bare # 0.35.0 comment still resolves and main audits clean today. It stopped publishing the bare alias at 0.36.0 — only v0.36.0 exists:

refs/tags/0.35.0
refs/tags/v0.34.0
refs/tags/v0.35.0
refs/tags/v0.36.0

Dependabot carries the existing comment style forward, so on #63 it writes # 0.36.0, and zizmor's ref-version-mismatch — new in 1.29.0, which #63 pulls in by bumping zizmor-action v0.6.0 → v0.6.2 — correctly flags it as "points to unknown ref ... is pointed to by tag v0.36.0". That single medium finding is the only thing failing #63; its other 15 checks pass.

Fixing the style here rather than in the bump is deliberate: dependabot then picks up the v prefix on this and every future trivy bump, instead of the same finding recurring each time. It also avoids pushing to a Dependabot branch — per the note in basecamp/.github's dependabot-sync-actions-comments.yml, any non-Dependabot push to such a PR flips the actor on the retriggered pull_request runs and lifts GitHub's Dependabot sandbox over freshly bumped, unreviewed action pins.

57a97c7e is the same commit under both tags, so the pin is unchanged — comment only. Verified with zizmor --persona=regular (online) 1.29.0 against this tree: no findings.

Once this lands, rebasing #63 should take it green.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/security.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Normalizes the Trivy action’s version comment to match its v-prefixed tag without changing the pinned commit.

Changes:

• Updates 0.35.0 to v0.35.0, preventing future audit mismatches.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

Heads up on the red Govulncheck here — it is not from this change, which is one character inside a YAML comment.

It fails on Go standard library advisories (Fixed in: encoding/asn1@go1.26.6, 3 stdlib vulns reachable, e.g. editor/editor.go:39:21 → exec.Command → asn1.Unmarshal). Nothing in a workflow comment can reach Go code analysis.

Confirmed it's time-based rather than tree-based: #63's Govulncheck passed at ~09:24 today, and re-running that same job on the same commit an hour later now fails identically. So a new stdlib advisory landed in between and every open cli PR will show it until the Go toolchain is bumped. Worth its own issue — it's a real finding, just not one this PR introduced or should carry.

GitHub Actions audit — the check this PR actually targets — passes here.