security ci fixes

Author: gleb619

.github/workflows/ci-cd.yml

@@ -40,6 +40,9 @@ jobs:
         working-directory: frontend
         run: yarn build
 
+      - name: Generate changelog
+        run: yarn --cwd frontend changelog && mv frontend/CHANGELOG.md CHANGELOG.md
+
       - name: Cache frontend build
         uses: actions/cache@v4
         id: frontend-cache
@@ -104,19 +107,6 @@ jobs:
           name: backend-jar
           path: backend/build/libs/*.jar
 
-      - name: Setup Node.js for Changelog
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache-dependency-path: 'frontend/yarn.lock'
-
-      - name: Install dependencies for Changelog
-        working-directory: frontend
-        run: yarn install --frozen-lockfile
-
-      - name: Generate changelog
-        run: yarn --cwd frontend changelog && mv frontend/CHANGELOG.md CHANGELOG.md
-
   security-scan:
     runs-on: ubuntu-latest
     needs: build-backend
@@ -125,19 +115,13 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Trivy
+      - name: Run Security Scan
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy scan results
-        uses: github/codeql-action/upload-sarif@v2
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
+          exit-code: '1'
+          ignore-unfixed: true
 
   build-and-push:
     runs-on: ubuntu-latest