[jordanpadams]

Summary

Adds .github/workflows/container-scan.yaml, which builds docker/Dockerfile and scans the image with Trivy for known vulnerabilities in OS packages and language libraries. Dependabot does not cover OS-level packages (Debian/Ubuntu/Alpine), so this is the CI-side check for the findings AWS ECR/Inspector reports after an image is pushed.

Behavior

• Runs on pull requests and pushes to main that touch docker/**, weekly on a schedule (to catch CVEs published after the last build), and on manual dispatch.
• Builds with pull: true so the scan reflects the current base image.
• Reports CRITICAL and HIGH findings that have a fix available (ignore-unfixed: true).
• Uploads SARIF to the Security > Code scanning tab on non-pull-request runs. Pull requests from Dependabot and forks have a read-only token, so they skip the upload.
• Fails the run when a finding at or above the threshold exists. Set exit-code to '0' in the "Vulnerability Gate" step for report-only.
• Every step is skipped when docker/Dockerfile does not exist, so repos created from this template without Docker are unaffected.

Notes

• aquasecurity/trivy-action is pinned to the commit for v0.36.0 rather than a tag. Dependabot's github-actions ecosystem (already configured) keeps the pin current.
• The existing dependabot.yml already includes the docker ecosystem for /docker/, which opens PRs to bump the base image. No change needed there.
• Repos whose image build needs build arguments or a prior build step (for example a Java jar) should add the Trivy step to their existing build workflow instead; see NASA-PDS/registry-api for an example.

Testing

Workflow YAML parses. The template has no docker/Dockerfile, so the scan steps are skipped here; the first real run happens in a repo that adds one.

[Copilot]

🟢 Approval recommended

No active review issues were identified in the workflow adding container image vulnerability scanning, SARIF reporting, and failure gating.

No open issues 🎉

What changed in this PR

Adds a GitHub Actions workflow that builds docker/Dockerfile and scans the resulting container image with Trivy for fixable high and critical OS or language-library vulnerabilities.

Changes:

• Runs on Docker-related pull requests, pushes to main, weekly schedules, and manual dispatches.
• Builds images with the current base image and scans for vulnerabilities.
• Uploads SARIF results and applies a vulnerability failure gate.

File	Description
.github/​workflows/​container-scan.yaml	Defines conditional container image building, Trivy vulnerability scanning, SARIF reporting, and vulnerability failure handling.

_{Review effort: Lite}