[AlexanderDokuchaev]

Changes

• Added nightly schedule trigger (0 0 * * *) to the sdl workflow.
• Trivy job runs only on schedule, manual run (workflow_dispatch) and push to release_v* branches.
• Trivy scans once with JSON output, then trivy convert generates:
  • HTML report (uploaded as artifact, same template as before);
  • table report printed to job logs.
• Added "Trivy: packages to update" table to the GitHub job summary (target, package, installed version, fixed versions, vulnerability IDs with severity).

Reason for changes

• Trivy results were available only in the HTML artifact, which is inconvenient to check.
• Avoid blocking PRs and develop pushes by vulnerabilities found in requirements, while keeping regular scans via nightly runs and release branches.

Related tickets

Tests

https://github.com/openvinotoolkit/nncf/actions/runs/39744361579

[Copilot]

🟢 Approval recommended

No blocking issues remain, and the linked run confirms reporting and artifact upload succeed even after the scan step fails.

No open issues 🎉

What changed in this PR

Reworks NNCF’s SDL workflow to keep regular security scans while preventing Trivy findings from blocking PRs and develop pushes, and makes results easier to inspect.

Changes:

• Adds a nightly schedule and limits Trivy execution to scheduled runs, manual runs, and release-branch pushes.
• Converts a single JSON scan into HTML and table reports.
• Prints scan results in logs and adds a package-update table to the job summary.

File	Description
.github/​workflows/​sdl.yml	Updates scan triggers and adds report conversion, log output, and summary generation.

_{Review effort: Balanced}