trivy-fs-scan: enforce by default; 'false' is the emergency escape

Feedback from the first rollout: a default-off gate is the wrong way
around — the default must be active and enforced, with the opt-out as an
explicit, documented per-invocation emergency flag (same posture as the
image-scan gate).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

README.md

@@ -123,9 +123,10 @@ from repo secrets; no-op when the secret is unset (build stays unsigned).
 ### Trivy Filesystem Scan
 
 Scans the checked-out workspace for vulnerable dependencies (lockfile-based) —
-for repos that build artifacts (APKs) rather than images. Non-blocking by
-default (`enforce: "false"`); requires committed Gradle lockfiles and the
-trivy binary on the runner. Pin the job to `linux,build,amd64`.
+for repos that build artifacts (APKs) rather than images. Enforcing by default
+(fails on fixable HIGH/CRITICAL); `enforce: "false"` is a temporary emergency
+escape only. Requires committed Gradle lockfiles and the trivy binary on the
+runner. Pin the job to `linux,build,amd64`.
 
 **Location:** [`./trivy-fs-scan`](./trivy-fs-scan)
 

trivy-fs-scan/action.yaml

@@ -18,10 +18,12 @@ inputs:
     default: HIGH,CRITICAL
   enforce:
     description: >
-      "true" fails the job on findings with an available fix; "false" only
-      reports them (start non-blocking, flip once the noise level is known).
+      "true" (the default) fails the job on findings with an available fix.
+      Set "false" ONLY as a temporary emergency escape (e.g. an urgent fix
+      must ship while a finding is being addressed) — always with an inline
+      comment in the workflow explaining why.
     required: false
-    default: "false"
+    default: "true"
 
 runs:
   using: composite