[vcauesantos]

What happened

vcluster-sdk is a Go library. It publishes no image, so the daily CVE scan never covers it. The cve-scan action can only scan images: image-ref is required, the action pulls the image, and the Snyk adapter runs snyk container test. So libraries get no CVE alerts in the Security tab, and the cve-remediation agent never sees them.

What this PR changes

cve-scan can now scan a go.mod instead of an image. A new source-path input points at a manifest inside the checkout. When it is set, the action skips the registry login and the image pull, and Snyk runs snyk test --file=<path>. Counting, the severity threshold, Slack messages and the job summary are shared with image mode. The summary and Slack text name the repo and path instead of an image.

Exactly one of image-ref and source-path must be set. image-ref is now optional. Setting both, or neither, is a config error. A source path must be relative, stay inside the checkout, and exist. dockerfile-path only makes sense for an image, so it is rejected in source mode.

Source SARIF gets its own category. Runs are keyed as Snyk/OpenSource/<path>/..., so they never collide with the image categories already in the Security tab.

Each vulnerability is counted once. snyk test lists one entry per dependency path, so the same CVE can appear several times. Source mode dedupes by id. Image mode counts exactly as before.

Existing callers are unaffected. With source-path empty, every image caller runs the same code as today, and the result JSON still uses the image key. That keeps the change safe to ship on cve-scan/v1.

The caller must check out the code and set up Go before the action, since Snyk resolves Go modules with the Go toolchain. The README has a source-mode example.

How it was tested

• 20 new bats tests cover the source command and flags, no pull or login, both and neither inputs, bad and missing paths, dockerfile-path with a source path, the dedupe, and the SARIF category. All 166 tests pass, also under bash 5 in Docker.
• The existing image tests pass unchanged.
• A new composite smoke step calls the action with a missing source-path and checks it fails with the path in the summary.
• make lint (shellcheck, actionlint, zizmor) and make check-docs pass.

Not yet checked against real Snyk: the tool name and category it writes for snyk test. The vcluster-sdk caller will test that from this branch before merge.

Related to DEVOPS-1882