Add Trivy image vulnerability scan

.gitea/workflows/ci.yaml

@@ -49,6 +49,19 @@ jobs:
             -t mikhaillobanov/devops-platform:${GITHUB_SHA} \
             .
 
+        - name: Scan Docker image with Trivy
+          if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+          run: |
+            docker run --rm \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$HOME/.cache/trivy:/root/.cache/" \
+              aquasec/trivy:0.76.0 image \
+              --scanners vuln \
+              --severity HIGH,CRITICAL \
+              --ignore-unfixed \
+              --exit-code 1 \
+              mikhaillobanov/devops-platform:${GITHUB_SHA}
+
       - name: Push Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |