SQUASH: fidgeting with Docker Image Build Action

Author: ciroque

.github/workflows/build-and-sign-image.yml

@@ -53,11 +53,13 @@ jobs:
  push: false
  tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
 
+ # NOTE: This runs statically against the latest tag in Docker Hub which was not produced by this workflow
+ # This should be updated once this workflow is fully implemented
  - name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@1f0aa582c8c8f5f7639610d6d38baddfea4fdcee # 0.9.2
  continue-on-error: true
  with:
- image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+ image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
  format: 'sarif'
  output: 'trivy-results-${{ inputs.image }}.sarif'
  ignore-unfixed: 'true'