From 60b2631237a32cf19aef82d42c31af84e40e1134 Mon Sep 17 00:00:00 2001
From: Mikhail Lobanov <shallingstar@yandex.ru>
Date: Wed, 14 Oct 2026 22:49:49 +0300
Subject: [PATCH] Add Trivy image vulnerability scan

---
 .gitea/workflows/ci.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 3f3c38a..333abd5 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -49,6 +49,19 @@ jobs:
             -t mikhaillobanov/devops-platform:${GITHUB_SHA} \
             .
 
+        - name: Scan Docker image with Trivy
+          if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+          run: |
+            docker run --rm \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$HOME/.cache/trivy:/root/.cache/" \
+              aquasec/trivy:0.76.0 image \
+              --scanners vuln \
+              --severity HIGH,CRITICAL \
+              --ignore-unfixed \
+              --exit-code 1 \
+              mikhaillobanov/devops-platform:${GITHUB_SHA}
+
       - name: Push Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |