ci: install latest trivy and verify scan inputs

Enable NuGet lock files so Trivy has dependency targets, fail PR checks when no lock files or language-specific files are detected, and let the installer fetch the latest Trivy release.

.gitea/workflows/pr-checks.yml

@@ -20,6 +20,15 @@ jobs:
       - name: Restore dependencies
         run: dotnet restore
 
+      - name: Verify Trivy dependency scan inputs
+        run: |
+          lock_count="$(find . -name packages.lock.json -not -path "*/bin/*" -not -path "*/obj/*" | tee trivy-targets.txt | wc -l)"
+          echo "Trivy NuGet lock files: ${lock_count}"
+          if [ "${lock_count}" -eq 0 ]; then
+            echo "::error::No packages.lock.json files found. Trivy would scan 0 NuGet dependency files."
+            exit 1
+          fi
+
       # ── Linting ──
 
       - name: Lint C# code style
@@ -38,10 +47,19 @@ jobs:
 
       - name: Install Trivy
         run: |
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.60.0
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+          trivy --version
 
       - name: Trivy filesystem security scan
-        run: trivy fs --exit-code 1 --severity HIGH,CRITICAL .
+        run: |
+          set +e
+          trivy fs --scanners vuln,misconfig,secret --exit-code 1 --severity HIGH,CRITICAL . 2>&1 | tee trivy-scan.log
+          trivy_exit="${PIPESTATUS[0]}"
+          if ! grep -Eq "Number of language-specific files[[:space:]]+num=[1-9][0-9]*" trivy-scan.log; then
+            echo "::error::Trivy did not detect any language-specific dependency files."
+            exit 1
+          fi
+          exit "${trivy_exit}"
 
       # ── Build ──
 
@@ -57,4 +75,4 @@ jobs:
       # ── Tests ──
 
       - name: Run tests
-        run: dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --verbosity normal
+        run: dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --verbosity normal