530def213b
Add a scan job between check-docker and build-and-push. Builds each image locally (no push, current platform only), runs Trivy v0.35.0 against it, and fails on unfixed HIGH/CRITICAL CVEs. build-and-push only runs if both scans pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| workflows | ||