Docker vulnerability scan #1259

	name: Docker vulnerability scan

	on:
	workflow_dispatch:
	schedule:
	- cron: "0 4 * * *"

	permissions:
	contents: write
	security-events: write

	jobs:
	docker-vulnerability-scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- name: Build Form Viewer
	run: \|
	docker build --platform=linux/amd64 --provenance false -t forms-client \
	--build-arg COGNITO_APP_CLIENT_ID="COGNITO_APP_CLIENT_ID" \
	--build-arg COGNITO_USER_POOL_ID="COGNITO_USER_POOL_ID" \
	--build-arg HCAPTCHA_SITE_KEY="HCAPTCHA_SITE_KEY" \
	--build-arg ZITADEL_URL="ZITADEL_URL" \
	--build-arg ZITADEL_PROJECT_ID="ZITADEL_PROJECT_ID" \
	--build-arg API_URL="API_URL" \
	--build-arg NEXT_DEPLOYMENT_ID=$GITHUB_SHA .

	- name: Docker vulnerability scan
	uses: cds-snc/security-tools/.github/actions/docker-scan@837a88b6337d4842543184c8eac97a8adac8f302 # v4.0.3
	env:
	TRIVY_DB_REPOSITORY: ${{ vars.TRIVY_DB_REPOSITORY }}
	with:
	docker_image: "forms-client"
	dockerfile_path: "Dockerfile"
	token: ${{ secrets.GITHUB_TOKEN }}

Provide feedback