chore(ci): Remove trivy - model-regitsry

[sameerdattav]

Removing trivy action - as instructed by @andreyvelich following kubeflow/katib#2644

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign al-pragliola for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tarilabs]

/hold

I'm lost why we need to remove it from Model-Registry, please?

• we had it pinned to latest v0.35.0 at the beginning of the month, so we're not impacted.
• we are also not affected by this type of attack because @Al-Pragliola implemented the OpenSSF scorecard sha-pinning for all GitHub Actions:
  👉 chore: pin all GHAs deps #2370
  which IMHO is a very commendable work.

[sameerdattav]

@tarilabs , the removal was being done across all Kubeflow repos after the recent Trivy incident, so I followed the same approach here.

If there’s already consensus that Model Registry isn’t affected because of pinning , im happy to revert this.

@andreyvelich — could you please confirm what we should do here?

[tarilabs]

thanks, as mentioned:

• we had it pinned to latest v0.35.0 at the beginning of the month, so we're not impacted.
• we are also not affected by this type of attack because @Al-Pragliola implemented the OpenSSF scorecard sha-pinning for all GitHub Actions:
  👉 chore: pin all GHAs deps #2370
  which IMHO is a very commendable work

we Disabled the Workflow as discussed:

and we are waiting further instructions from @kubeflow/security-team @kubeflow/kubeflow-steering-committee