Setup trivy scanning

.github/workflows/docker.yaml

@@ -8,6 +8,9 @@ on:
 
     tags:
       - v*
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
 
 env:
   IMAGE_NAME: thanos-remote-read
@@ -21,17 +24,22 @@ jobs:
 
       - name: Build image
         run: docker build -t image .
+
+      - name: Sanitize repo slug
+        uses: actions/github-script@v4
+        id: github_id
+        with:
+          result-encoding: string
+          script: return 'docker.pkg.github.com/${{ github.repository }}/${{ env.IMAGE_NAME }}'.toLowerCase()
 
       - name: Log into registry
-        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login docker.pkg.github.com -u ${{ github.actor }} --password-stdin
           echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
 
       - name: Push image
-        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
         run: |
-          GITHUB_ID="docker.pkg.github.com/${{ github.repository }}/$IMAGE_NAME"
+          GITHUB_ID="${{ steps.github_id.outputs.result }}"
           DOCKERHUB_ID="gresearchdev/$IMAGE_NAME"
 
           # Change all uppercase to lowercase for github
@@ -58,3 +66,18 @@ jobs:
             docker tag image $DOCKERHUB_ID:latest
             docker push $DOCKERHUB_ID:latest
           fi
+
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2
+        with:
+          image-ref: '${{ steps.github_id.outputs.result }}:${{ github.sha }}'
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: 'trivy-results.sarif'