Merge pull request #134 from hairyhenderson/dependabot/github_actions… #121

	name: Docker Image Scan
	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	jobs:
	docker-build:
	permissions:
	security-events: write
	runs-on: ubuntu-latest
	env:
	DOCKER_BUILDKIT: 1
	DOCKER_CLI_EXPERIMENTAL: enabled
	steps:
	- uses: actions/checkout@v4
	- name: Quick build (linux/alpine only)
	run: \|
	docker build --target alpine -t go-which .
	- name: Run Trivy vulnerability scanner (table output)
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: go-which
	format: table
	exit-code: 1
	ignore-unfixed: true
	vuln-type: os,library
	severity: CRITICAL,HIGH
	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: go-which
	format: sarif
	output: trivy-results.sarif
	exit-code: 1
	ignore-unfixed: true
	vuln-type: os,library
	severity: CRITICAL,HIGH
	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: 'trivy-results.sarif'
	if: always() && github.repository == 'hairyhenderson/go-which'

Provide feedback