added: Docker Trivy scanning tool and actions update

.github/workflows/build.yml

@@ -18,24 +18,22 @@ jobs:
     if: github.actor == 'ammnt'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       packages: write
       id-token: write
       security-events: write
 
     steps:
       - name: Checkout repository🧱
-        uses: actions/[email protected].3
+        uses: actions/[email protected].4
 
       - name: Install cosign🔒
-        if: github.event_name != 'pull_request'
         uses: sigstore/[email protected]
 
       - name: Setup Docker buildx🛠️
         uses: docker/[email protected]
 
       - name: Log into ${{ env.REGISTRY }}🔑
-        if: github.event_name != 'pull_request'
         uses: docker/[email protected]
         with:
           registry: ${{ env.REGISTRY }}
@@ -75,18 +73,13 @@ jobs:
           target: ghcr.io/ammnt/nginx:main
           tag: ghcr.io/ammnt/nginx:main
           overwrite: true
-      - run: echo "${REPORT}"
-        env:
-          REPORT: ${{ steps.slim.outputs.report }}
 
       - name: Test the Docker image🧪
         run: |
           docker run -d --rm -p 127.0.0.1:8080:8080/tcp ghcr.io/ammnt/nginx:main
           curl -v http://127.0.0.1:8080 || exit 1
 
       - name: Analyze for critical and high CVEs💊
-        id: docker-scout-cves
-        if: ${{ github.event_name != 'pull_request_target' }}
         uses: docker/[email protected]
         with:
           command: cves,sbom
@@ -95,20 +88,34 @@ jobs:
           summary: true
 
       - name: Upload SARIF result📊
-        id: upload-sarif
-        if: ${{ github.event_name != 'pull_request_target' }}
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: sarif.output.json
 
+      - name: Run Trivy vulnerability scanner💊
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: ghcr.io/ammnt/nginx:main
+          scan-type: image
+          format: "github"
+          output: "dependency-results.sbom.json"
+          severity: "MEDIUM,HIGH,CRITICAL"
+          scanners: "vuln"
+
+      - name: Upload Trivy report as a Github artifact📊
+        uses: actions/[email protected]
+        with:
+          name: trivy-sbom-report
+          path: "${{ github.workspace }}/dependency-results.sbom.json"
+          retention-days: 20
+
       - name: Push the Docker images to registries💾
         run: |
           docker push ghcr.io/ammnt/nginx:main
           docker tag ghcr.io/ammnt/nginx:main ammnt/nginx:main
           docker push ammnt/nginx:main
 
       - name: Sign the published Docker image🔐
-        if: ${{ github.event_name != 'pull_request' }}
         env:
           COSIGN_EXPERIMENTAL: "true"
         run: |