Change build.yaml

.github/workflows/build.yaml

@@ -28,6 +28,31 @@ jobs:
           push: true
           tags: |
             tomacgg/devops-security-app:latest
+
+scan:
+  name: Scan
+  needs: [ build ]
+  runs-on: ubuntu-latest
+  steps:
+  - name: Login to Docker Hub
+    uses: docker/login-action@v2
+    with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+  - name: Docker Scout CVEs
+    uses: docker/[email protected]
+    with:
+      command: cves
+      image: tomacgg/devops-security-app:latest
+      # only-fixed: true
+      only-severities: critical,high
+      ignore-base: false
+      ignore-unchanged: false
+      write-comment: true
+      github-token: ${{ secrets. PERSONAL_ACCESS_TOKEN }}
+      exit-code: true
+      exit-on: vulnerability
+
   test:
     name: Test
     needs: [ build ]