ops: updated GHA runs-on, trivy

Author: ironhalik

.github/workflows/main.yml

@@ -14,7 +14,7 @@ env:
 jobs:
   build:
     name: Build Docker image
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: write
@@ -37,7 +37,7 @@ jobs:
 
   test-shellcheck:
     name: Run Shellcheck
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -52,7 +52,7 @@ jobs:
 
   test-trivy:
     name: Run Trivy
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - build
     permissions:
@@ -64,20 +64,19 @@ jobs:
       - name: Pull current image
         run: docker pull ${{ env.LOCAL_IMAGE }}
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.23.0
+        uses: aquasecurity/trivy-action@0.28.0
         with:
           image-ref: ${{ env.LOCAL_IMAGE }}
           exit-code: "1"
           ignore-unfixed: true
-          vuln-type: "os,library"
           severity: "HIGH,CRITICAL"
           skip-dirs: /usr/local/bin/
           scanners: "vuln"
           hide-progress: true
 
   test-bats:
     name: Run Bats Tests
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - build
     permissions:
@@ -108,7 +107,7 @@ jobs:
       - test-shellcheck
       - test-trivy
       - test-bats
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: write

.github/workflows/periodic-scan.yml

@@ -12,7 +12,7 @@ env:
 jobs:
   test-trivy:
     name: Run Trivy
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: read
@@ -22,12 +22,11 @@ jobs:
       - name: Pull current image
         run: docker pull ${{ env.LOCAL_IMAGE }}
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.23.0
+        uses: aquasecurity/trivy-action@0.28.0
         with:
           image-ref: ${{ env.LOCAL_IMAGE }}
           exit-code: "1"
           ignore-unfixed: true
-          vuln-type: "os,library"
           severity: "HIGH,CRITICAL"
           skip-dirs: /usr/local/bin/
           scanners: "vuln"