trivy #451

	name: trivy
	on:
	schedule:
	- cron: "40 11 * * 0"
	workflow_dispatch:
	workflow_run:
	workflows:
	- Release Retina Container Images
	types:
	- completed
	permissions:
	contents: read
	jobs:
	scan:
	permissions:
	contents: read
	security-events: write
	name: Trivy Scan
	strategy:
	fail-fast: false
	matrix:
	image: ["retina-agent", "retina-init", "retina-operator"]
	runs-on: ubuntu-latest # trivy only supports running on Linux
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Get Tag
	run: \|
	echo "TAG=$(make version)" >> $GITHUB_ENV

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
	with:
	image-ref: "ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ env.TAG }}"
	format: "template"
	template: "@/contrib/sarif.tpl"
	output: "trivy-results.sarif"
	severity: "CRITICAL,HIGH"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-results.sarif"

Provide feedback