ci(release): move CodeQL, Trivy, and Zizmor to advisory (#3693)

* ci(release): Move CodeQL, Trivy, and Zizmor to advisory

* docs(ci): describe advisory static findings for tagged releases

Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

---------

Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

Author: purp

.github/workflows/release-tag.yml

@@ -142,7 +142,7 @@ jobs:
     with:
       candidate_ref: ${{ inputs.tag || github.ref_name }}
       fail-on-codex-findings: true
-      fail-on-static-findings: true
+      fail-on-static-findings: false
       images: |
         ghcr.io/nvidia/openshell/gateway:${{ needs.compute-versions.outputs.source_sha }}
         ghcr.io/nvidia/openshell/sandbox:${{ needs.compute-versions.outputs.source_sha }}

CI.md

@@ -103,10 +103,13 @@ Actions or call it from another workflow. All applicable children analyze the
 candidate snapshot. Cargo Deny uses its existing NVIDIA self-hosted runner and
 CI container.
 
-Tagged releases treat CodeQL, Trivy, Zizmor, Cargo Deny, and Codex Security
-findings as failures of the currently implemented qualification profile. A
-profile failure does not prevent a pre-release candidate's complete artifact
-set from being published, but it does prevent stable publication.
+Tagged releases treat Cargo Deny and Codex Security findings as failures of the
+currently implemented qualification profile. A profile failure does not prevent
+a pre-release candidate's complete artifact set from being published, but it
+does prevent stable publication. CodeQL, Trivy, and Zizmor findings are
+temporarily informational for tagged releases: the existing findings were
+reviewed and accepted for v0.1.0 and will be addressed in 0.1.x releases.
+Scanner failures still fail qualification.
 
 ```shell
 gh workflow run security-scan.yml --ref main \

architecture/build.md

@@ -536,8 +536,10 @@ RFC's complete qualification coverage.
 The tagged release workflow calls the aggregate Security Scan after publishing
 the candidate's commit-addressed gateway, sandbox, and supervisor images. CodeQL,
 Trivy, Cargo Deny, and Actionlint/Zizmor run for every release tag; Codex Security
-also runs for pre-release tags. High or Critical findings and scanner failures
-fail qualification.
+also runs for pre-release tags. Scanner failures, Cargo Deny advisories, and
+High or Critical Codex Security findings fail qualification. CodeQL, Trivy, and
+Zizmor findings are temporarily informational while the findings accepted for
+v0.1.0 are addressed in 0.1.x releases.
 
 The `Release Qualification` job aggregates security, conformance, feature,
 Docker E2E, and VM E2E results. The currently implemented profile gates stable