[Britania Rodriguez Reyes (britaniar)]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Ports the weekly Trivy issue reuse and supersession behavior from kubefleet-dev/kubefleet@60dea36.

• Reuses the newest open security,trivy report created in the current ISO week, even if its title has been edited.
• Creates a weekly report when needed, then comments on and closes superseded reports, including same-week duplicates.
• Paginates all matching open reports and excludes pull requests.
• Includes the ISO week and last-update date in the scan summary.

Preserves the daily schedule, image scans, pinned actions, networking security-team mention, remediation instructions, and vulnerability enforcement on non-scheduled runs.

Which issue(s) this PR fixes:

N/A.

Requirements:

• run make reviewable for basic local test
• Read and followed fleet-networking's Code of conduct.
• uses conventional commit messages
• includes documentation
• adds unit tests

How has this code been tested

Focused checks were kept in session-local artifacts to leave this PR scoped to the workflow:

• node --test "$env:TRIVY_REGRESSION_TEST": passed, 16 checks against the actual embedded JavaScript with mocked GitHub APIs. Covers weekly reuse, new-week creation, duplicate cleanup, pagination over 205 reports, PR exclusion, ISO year boundaries, and failure propagation before report closure. On the original implementation, 14 checks failed and two passed.
• & "$env:PYTHON_EXE" "$env:TRIVY_WORKFLOW_CHECK": passed. Parses workflow YAML with PyYAML, validates every scan-job shell step using bash -n, and compares against upstream to ensure only report formatting and issue-management logic changed.
• git -c core.whitespace=cr-at-eol diff --check: passed. The workflow retains its existing CRLF line endings.

The test environment variables above point to session-local regression and workflow-validation scripts, which are not committed; PYTHON_EXE selects the local Python installation. make reviewable, Go tests, and live image scans were not run for this workflow-only change. GitHub API calls were mocked; no real security reports were changed during validation.

Special notes for your reviewer

Like the reference implementation, reports are identified by their security and trivy labels and grouped by creation date, not mutable title text. Existing daily reports created during the current ISO week are reused. Other matching open reports are closed as not_planned only after the current report is successfully created or updated.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.06%. Comparing base (632ed6d) to head (8e75517).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #438      +/-   ##
==========================================
- Coverage   67.21%   67.06%   -0.16%     
==========================================
  Files          34       34              
  Lines        3859     3859              
==========================================
- Hits         2594     2588       -6     
- Misses       1085     1091       +6     
  Partials      180      180              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.