fix(security-deep): use aquasecurity/trivy-action instead of community install script

.github/workflows/security-deep.yml

@@ -120,23 +120,16 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           persist-credentials: false
-      - name: Create reports directory
-        run: mkdir -p reports/trivy
-
-      - name: Install Trivy CLI
-        run: |
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | \
-            sh -s -- -b /usr/local/bin v0.65.0
-          trivy --version
-
       - name: Run full Trivy filesystem, dependency, and IaC scan
-        run: |
-          # --exit-code 0: reporting-only scan; do NOT fail the step on vulnerabilities
-          trivy fs . \
-            --scanners vuln,misconfig \
-            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
-            --format sarif \
-            --output reports/trivy/trivy-full.sarif
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln,misconfig
+          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          format: sarif
+          output: reports/trivy/trivy-full.sarif
+          exit-code: '0'
       - name: Verify SARIF file exists
         id: verify-sarif
         run: |

apps/rook/src/main.rs

@@ -174,13 +174,22 @@ async fn announce_bootstrap_if_needed(container: &di::RookContainer) -> anyhow::
         match setup_token {
             Some(token) => {
                 // Sanitize: replace control/non-printable chars to prevent log injection
-                let sanitized: String = token.chars().map(|c| {
-                    if c.is_ascii_control() || c == '"' || c == '\\' || c == '\n' || c == '\r' || c == '\t' {
-                        '?'
-                    } else {
-                        c
-                    }
-                }).collect();
+                let sanitized: String = token
+                    .chars()
+                    .map(|c| {
+                        if c.is_ascii_control()
+                            || c == '"'
+                            || c == '\\'
+                            || c == '\n'
+                            || c == '\r'
+                            || c == '\t'
+                        {
+                            '?'
+                        } else {
+                            c
+                        }
+                    })
+                    .collect();
                 let preview = if sanitized.len() > 8 {
                     format!("{}…", &sanitized[..8])
                 } else {
@@ -189,7 +198,9 @@ async fn announce_bootstrap_if_needed(container: &di::RookContainer) -> anyhow::
                 tracing::warn!(setup_token_preview = %preview, setup_token_len = token.len(), "rook is in bootstrap mode; set the admin password before using the server");
                 // Only print full token to interactive TTY; otherwise show preview only
                 if atty::is(atty::Stream::Stderr) {
-                    eprintln!("rook bootstrap mode: use setup token {token} to set the admin password");
+                    eprintln!(
+                        "rook bootstrap mode: use setup token {sanitized} to set the admin password"
+                    );
                 } else {
                     eprintln!("rook bootstrap mode: use setup token {preview}… (len={}) to set the admin password", token.len());
                 }

crates/application/rook-usecases/src/route_request.rs

@@ -119,7 +119,8 @@ impl RouteRequest {
         req: CompletionRequest,
     ) -> Result<futures::stream::BoxStream<'static, Result<StreamChunk, CortexError>>, CortexError>
     {
-        self.execute_stream_with_format(req, ApiFormat::OpenAI).await
+        self.execute_stream_with_format(req, ApiFormat::OpenAI)
+            .await
     }
 
     pub async fn execute_stream_with_format(

crates/domain/rook-core/src/ports.rs

@@ -13,11 +13,11 @@ use chrono::{DateTime, Utc};
 use shared_kernel::{CacheKey, ConnectionId, CortexResult, ModelId, ProviderId};
 
 use super::{
-    ApiKeyId, ApiKeyRecord, ApiKeyRepositoryError, ApiKeySubject, NewSession, NewUser,
-    PasswordHash, ProviderConnection, RepositoryError, Session, SessionId, User, UserId,
+    ApiFormat, AuditEntry, CompletionRequest, CompletionResponse, HealthStatus, StreamChunk,
 };
 use super::{
-    ApiFormat, AuditEntry, CompletionRequest, CompletionResponse, HealthStatus, StreamChunk,
+    ApiKeyId, ApiKeyRecord, ApiKeyRepositoryError, ApiKeySubject, NewSession, NewUser,
+    PasswordHash, ProviderConnection, RepositoryError, Session, SessionId, User, UserId,
 };
 
 /// ---------------------------------------------------------------------------

crates/infrastructure/transport-axum/src/format_registry.rs

@@ -167,9 +167,7 @@ impl FormatTranslatorPort for FormatRegistry {
 }
 
 fn missing_translator(kind: &str, from: ApiFormat, to: ApiFormat) -> CortexError {
-    CortexError::invalid_request(format!(
-        "missing {kind} translator for {from:?} -> {to:?}"
-    ))
+    CortexError::invalid_request(format!("missing {kind} translator for {from:?} -> {to:?}"))
 }
 
 // ---------------------------------------------------------------------------

crates/infrastructure/transport-axum/tests/format_translation_integration.rs

@@ -202,16 +202,15 @@ fn anthropic_response_has_correct_structure() {
     assert_eq!(json["usage"]["output_tokens"], 5);
 }
 
-
 // ---------------------------------------------------------------------------
 // Registry-routed multi-format use case integration
 // ---------------------------------------------------------------------------
 
 use async_trait::async_trait;
 use futures::stream;
 use rook_core::{
-    ApiFormat, AuditEntry, AuditPort, CacheKey, CachePort, CompletionRequest,
-    FormatTranslatorPort, HealthStatus, ProviderPort, RequestMetadata, RouterPort, StreamChunk,
+    ApiFormat, AuditEntry, AuditPort, CacheKey, CachePort, CompletionRequest, FormatTranslatorPort,
+    HealthStatus, ProviderPort, RequestMetadata, RouterPort, StreamChunk,
 };
 use rook_usecases::RouteRequest;
 use std::{sync::Arc, time::Duration};
@@ -248,7 +247,10 @@ impl ProviderPort for RegistryTestProvider {
         }
     }
 
-    async fn complete(&self, req: &CompletionRequest) -> shared_kernel::CortexResult<CompletionResponse> {
+    async fn complete(
+        &self,
+        req: &CompletionRequest,
+    ) -> shared_kernel::CortexResult<CompletionResponse> {
         Ok(CompletionResponse {
             id: req.id.clone(),
             provider: self.id.clone(),
@@ -267,7 +269,9 @@ impl ProviderPort for RegistryTestProvider {
     async fn stream(
         &self,
         _req: &CompletionRequest,
-    ) -> shared_kernel::CortexResult<futures::stream::BoxStream<'static, shared_kernel::CortexResult<StreamChunk>>> {
+    ) -> shared_kernel::CortexResult<
+        futures::stream::BoxStream<'static, shared_kernel::CortexResult<StreamChunk>>,
+    > {
         Ok(Box::pin(stream::empty()))
     }
 }
@@ -278,7 +282,10 @@ struct RegistryTestRouter {
 
 #[async_trait]
 impl RouterPort for RegistryTestRouter {
-    async fn select(&self, _req: &CompletionRequest) -> shared_kernel::CortexResult<Arc<dyn ProviderPort>> {
+    async fn select(
+        &self,
+        _req: &CompletionRequest,
+    ) -> shared_kernel::CortexResult<Arc<dyn ProviderPort>> {
         Ok(self.provider.clone())
     }
 
@@ -293,7 +300,10 @@ struct NoopCache;
 
 #[async_trait]
 impl CachePort for NoopCache {
-    async fn get(&self, _key: &CacheKey) -> shared_kernel::CortexResult<Option<CompletionResponse>> {
+    async fn get(
+        &self,
+        _key: &CacheKey,
+    ) -> shared_kernel::CortexResult<Option<CompletionResponse>> {
         Ok(None)
     }