Add workflow to generate pre-filled risk exception documents from Trivy scans

[mehansen]

Related Issue

• The risk exception docs required before promoting images with CRITICAL/HIGH vulnerabilities are currently written by hand. This automates the boilerplate so the team only needs to fill in the justification part.

Changes Proposed

• New workflow generate-risk-exception-doc.yml: builds the lambda image at a given ref, scans with Trivy, and uploads a risk-exception.md artifact.
• New generateRiskExceptionTemplate() in security-summary.js that renders per-CVE tables (package, version, fix availability, reference) with blank justification/mitigation/timeline fields. Writes nothing when there are no findings.

Additional Information

• Severities and image/Dockerfile are configurable via env vars (currently set to CRITICAL,HIGH).

Testing

• Ran against my branch here and verified that the generated doc matches the HIGH vulnerabilities we currently have for the repo.

Checklist for Primary Reviewer

• Any large-scale changes have been deployed and smoke tested
• Any content updates (user-facing error messages, etc) have been approved by content team
• Any dependencies introduced have been vetted and discussed

[github-actions]

🔒 Security Scan Results

⚠️ Found 3 vulnerabilities

Severity	Total
🟠 High	2
🟡 Medium	1

📦 did-lambda

Severity	Count
🟠 High	2
🟡 Medium	1

---

View detailed results: Security tab
Last updated: 2026-09-28 15:59:46 UTC

[kevinfiol]

Looks good 👍 Thanks for updating the documentation as well.