[coval-cale]

The weekly Trivy scan of the deployed runner and api images fails without telling anyone. The Oct 26 run on main found fixable HIGH/CRITICAL findings and the only trace is a red run in Actions. trivy.yml now publishes a failure notice to the benchmark-infra alerts topic, which slack-notifier posts to the benchmarks alerts channel. It is the same path bump-images.yml uses.

Part of BENCH-1203.

Changes

• Add a notify job with needs: scan and if: failure(). It runs once per workflow run, not once per matrix image, and never on success.
• It signs in as the existing runner-scanner SA through WIF and publishes a source: github-actions payload with the repo, ref, actor and run URL.
• The message does not list findings or counts. The run's step summary and the Security tab (SARIF upload, unchanged) carry those.
• The scan job is unchanged.

Validation

• actionlint .github/workflows/trivy.yml passes.
• The payload renders in slack-notifier's formatter as *trivy.yml FAILED* plus the summary and run link (checked locally in benchmark-infra).
• Not run end to end. That needs the IAM grant below applied first.

Rollout

Merge after coval-ai/benchmark-infra#295 is applied. Until then the notify step fails with a permission error and nothing posts. To confirm, trigger Trivy manually with workflow_dispatch. It will fail on the current findings and should post one message.