fix(vhd-scanning): install trivy via PMC with GitHub fallback for unsupported SKUs

[djsly]

trivy-scan.sh downloaded trivy directly from GitHub releases with a hardcoded TRIVY_VERSION=0.69.2, bypassing package management and subject to rate limiting.

Changes

• PMC install for Ubuntu: adds Microsoft PMC prod repo (packages.microsoft.com/ubuntu/${os_version}/prod) with modern gpg --dearmor + signed-by= keyring; GPG key download wrapped in retrycmd_if_failure
• PMC install for AzureLinux: delegates to sourced dnf_install (from cse_helpers_mariner.sh via provision_source_distro.sh) which includes dnf_makecache on retry
• GitHub fallback for SKUs without PMC packages (CBLMariner, Flatcar, AzureContainerLinux, AzureLinuxOSGuard): preserves original curl/tar flow, version configurable via TRIVY_VERSION env var (default 0.69.2)
• Scan invocations changed from ./trivy → trivy; rm -f ./trivy at end is a no-op for PMC installs, cleanup for fallback

install_trivy() {
    case "$os_sku" in
        Ubuntu)      # apt via PMC prod repo + gpg --dearmor keyring
        AzureLinux)  # dnf_install 5 1 60 trivy  (sourced, includes makecache)
        *)           # GitHub release download (CBLMariner, Flatcar, ACL, OSGuard)
    esac
}

[Copilot]

Pull request overview

Updates the VHD post-build scanning script to stop downloading Trivy from GitHub releases and instead install it via the OS package manager (PMC-backed), then run scans using the system trivy binary.

Changes:

• Removed hardcoded Trivy version/arch and the GitHub curl/tar install flow.
• Added install_trivy() to install Trivy via apt (Ubuntu) or dnf (AzureLinux/Mariner).
• Switched scan invocations from ./trivy to trivy and removed the local binary cleanup.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[djsly]

@copilot can you review

[Copilot]

@copilot can you review

The current state of the code looks good to me. Here's my review summary:

✅ All CI checks passing (validate-pull-request-source, golangci-lint, Lint Shell/Bash Scripts, Go Unit Tests, Shell/Bash Script Unit Tests, Validate Components, etc.)

✅ No new shellcheck issues — the only warnings (SC2034 BLOB_URL unused, SC2068/SC2145 in the pre-existing retrycmd_if_failure echo) are all pre-existing.

✅ dnf_install 5 1 60 trivy correctly uses the function sourced from provision_source_distro.sh → cse_helpers_mariner.sh, which has the expected signature retries wait_sleep timeout ...packages and calls dnf_makecache on retry.

✅ Ubuntu PMC path — uses modern gpg --dearmor + signed-by= approach; gnupg installed before use; /etc/apt/keyrings created idempotently; GPG key download wrapped in retrycmd_if_failure 5 10 60.

✅ GitHub fallback — trivy binary extracted to $(pwd)/trivy; export PATH="$(pwd):$PATH" at line 211 makes it resolvable as trivy for all scan commands; TRIVY_VERSION is configurable via env var (defaults to 0.69.2); rm -f ./trivy at the end is a safe no-op for PMC installs and cleans up the GitHub-downloaded binary.

✅ repo_codename detection via ${UBUNTU_CODENAME:-$VERSION_CODENAME} from /etc/os-release handles all supported Ubuntu versions (20.04/22.04/24.04).

No issues found — LGTM! 🚀