Check docker image CVEs in vulnerabilities workflow #10

	name: Check vulnerabilities

	on:
	push:
	paths-ignore:
	- '**.md'
	pull_request:
	branches:
	- master
	paths-ignore:
	- '!**.md'
	release:
	types:
	- released

	env:
	DOCKER_REPOSITORY: geopython/pygeoapi

	jobs:

	vulnerabilities:
	runs-on: ubuntu-22.04
	defaults:
	run:
	working-directory: .
	steps:
	- name: Checkout pygeoapi
	uses: actions/checkout@v4
	- name: Scan vulnerabilities with trivy
	run: \|
	sudo apt-get install -y wget apt-transport-https gnupg lsb-release
	wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key \| gpg --dearmor \| sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
	echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" \| sudo tee -a /etc/apt/sources.list.d/trivy.list
	sudo apt-get update
	sudo apt-get install -y trivy
	trivy --exit-code 1 fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --ignore-unfixed .
	- name: Build locally the image from Dockerfile
	run: \|
	docker buildx build -t ${{ env.DOCKER_REPOSITORY }}:${{ github.sha }} --platform linux/amd64 --no-cache -f Dockerfile .
	- name: Scan locally built Docker image for vulnerabilities with trivy
	run: \|
	trivy --exit-code 1 image --severity HIGH,CRITICAL ${{ env.DOCKER_REPOSITORY }}:${{ github.sha }} --ignore-unfixed

Provide feedback