feat: add trivy vulnerability check #1

	name: Pull Request Workflow

	on:
	push:
	branches:
	#- '*' # Trigger on all branches for pull requests
	- feat/ING-4183

	jobs:
	build:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Maven
	uses: s4u/[email protected]
	with:
	java-version: 17
	java-distribution: temurin
	maven-version: 3.8.6

	- name: Login to Docker Hub
	uses: docker/login-action@v2
	with:
	username: ${{ secrets.DOCKER_HUB_USERNAME }}
	password: ${{ secrets.DOCKER_HUB_PASSWORD }}

	# Build Docker image
	- name: Build Docker image
	run: docker build -t halestudio-docker-image .

	# Push Docker image to a registry (optional)
	- name: Push Docker image
	run: \|
	echo "${{ secrets.DOCKER_HUB_PASSWORD }}" \| docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
	docker push halestudio-docker-image

	# Scan Docker image using Trivy
	- name: Scan Docker image for vulnerabilities
	uses: aquasecurity/[email protected]
	with:
	image-ref: 'halestudio-docker-image'
	scan-type: 'image'
	format: 'template'
	template: '/junit.tpl'
	output: 'trivy-scan-results.xml'
	ignore-unfixed: true
	vuln-type: 'os,library'
	severity: 'CRITICAL'

	# Upload Trivy scan results to GitHub Security tab
	#- name: Upload Trivy scan results to GitHub Security tab
	# uses: github/codeql-action/upload-sarif@v2
	# with:
	# sarif_file: 'trivy-scan-results.sarif'

	- name: Upload Trivy scan results
	uses: actions/upload-artifact@v2
	with:
	name: trivy-results
	path: trivy-results.json

Provide feedback