On cache miss, `aquasecurity/trivy-action@master` falls back to
`git clone https://github.com/aquasecurity/trivy` to fetch its
install script. The act_runner cache server is currently
unreachable from job containers (documented as "Cache server
(deferred)" in infra/README.md), so every run is a cache miss, so
every run hits the github.com anonymous rate limit and fails with:
fatal: could not read Username for 'https://github.com';:
terminal prompts disabled
Pass `GITHUBCOM_TOKEN` (the same zero-scope github.com PAT we use
for Renovate) as `GITHUB_TOKEN` env on the step. The action picks
it up automatically and authenticates the clone, lifting the rate
limit from 60 req/h anonymous to 5 000 req/h authenticated.
This unblocks the `scan` job. The cache server fix would also
unblock it (no fall-back clone in the first place), but is a
separate, larger infra change still pending.
Julien Gautier