Add Trivy Security Scan step to dev container workflow

Author: DevNiall

.github/workflows/build-devcontainer.yml

@@ -88,6 +88,43 @@ jobs:
             fi
             
             echo "=== Dev container validation completed! ==="
+      
+      # Using the custom Trivy Security Scan action from this repository
+      - name: Security Scan
+        id: security-scan
+        uses: smartdatafoundry/income_volatility_pipeline/.github/actions/trivy-security-scan@v1.0.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          registry: ${{ env.REGISTRY }}
+          severity: 'CRITICAL,HIGH'
+          detailed-severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          ignore-unfixed: 'true'
+          exit-code: '0'
+          artifact-name: 'security-scan-results'
+          artifact-retention-days: '30'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          post-pr-comment: 'true'
+
+      # Optional: Handle scan results programmatically
+      - name: Process scan results
+        run: |
+          echo "Security scan status: ${{ steps.security-scan.outputs.scan-status }}"
+          echo "Vulnerabilities found: ${{ steps.security-scan.outputs.vulnerability-count }}"
+          echo "Artifact ID: ${{ steps.security-scan.outputs.artifact-id }}"
+          
+          # You can add custom logic here based on the scan results
+          if [ "${{ steps.security-scan.outputs.scan-status }}" = "vulnerabilities_found" ]; then
+            echo "⚠️ Security vulnerabilities detected!"
+            echo "Consider reviewing the security report before deploying."
+            
+            # Optionally, you could fail the build for critical vulnerabilities:
+            # if [ "${{ steps.security-scan.outputs.vulnerability-count }}" -gt "10" ]; then
+            #   echo "❌ Too many vulnerabilities found (> 10), failing build"
+            #   exit 1
+            # fi
+          else
+            echo "✅ No critical or high severity vulnerabilities found!"
+          fi
 
       - name: Container info
         if: success()