Docker: Scan latest release image #399

	name: 'Docker: Scan latest release image'

	on:
	schedule:
	# Scan the image regularly (once a day).
	- cron: '44 4 * * *'

	jobs:
	build:
	permissions:
	contents: read # For actions/checkout to fetch code.
	security-events: write # For github/codeql-action/upload-sarif to upload SARIF results.
	name: Scan current image & report results
	runs-on: "ubuntu-latest"
	steps:
	# -
	# name: Check out repository code
	# uses: actions/checkout@v3
	# with:
	# fetch-depth: 0
	# -
	# name: Extract tag of latest release
	# run: \|
	# echo "TAG_VERSION=$(git describe --tags `git rev-list --tags --max-count=1`)" >> $GITHUB_ENV
	-
	name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: 'ghcr.io/${{ github.repository }}:latest'
	format: 'sarif'
	output: 'trivy-results.sarif'
	severity: 'CRITICAL,HIGH,MEDIUM'
	vuln-type: "os"
	-
	name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback