From 202b054938c0277a1e45a5b8a4e41ec4f99b0dcf Mon Sep 17 00:00:00 2001
From: Ana Alexandru-Gabriel <alexandru.ana@nokia.com>
Date: Tue, 23 Jun 2026 13:22:38 +0300
Subject: [PATCH 1/3] add clair (static vulnerability analysis) to CI

---
 .github/workflows/docker.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 619a91a..d6016c8 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -21,4 +21,20 @@ jobs:
       uses: docker/setup-buildx-action@v3
     - name: Build Docker Image
       run: |
-        GIT_BRANCH='refs/tags/0.0.0' docker buildx bake 
+        GIT_BRANCH='refs/tags/0.0.0' docker buildx bake --set release.output='type=docker'
+
+    - name: Save Docker image
+      run: |
+        docker save -o ${{ github.sha }} registry.onlinedi.vision:5000/od-official-server:v0.0.0
+
+    - name: Run Clair V4
+      uses: quay/clair-action@main
+      with:
+        image-path: ${{ github.sha }}
+        format: sarif
+        output: clair_results.sarif
+
+    - name: Upload sarif
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: clair_results.sarif

From 5abe4e2fef3713fdbf907b83c5c73e4ba93c2596 Mon Sep 17 00:00:00 2001
From: Ana Alexandru-Gabriel <alexandru.ana@nokia.com>
Date: Tue, 23 Jun 2026 13:38:21 +0300
Subject: [PATCH 2/3] swap clari for trivy

---
 .github/workflows/docker.yml | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d6016c8..e9614ac 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -21,20 +21,13 @@ jobs:
       uses: docker/setup-buildx-action@v3
     - name: Build Docker Image
       run: |
-        GIT_BRANCH='refs/tags/0.0.0' docker buildx bake --set release.output='type=docker'
-
-    - name: Save Docker image
-      run: |
-        docker save -o ${{ github.sha }} registry.onlinedi.vision:5000/od-official-server:v0.0.0
-
-    - name: Run Clair V4
-      uses: quay/clair-action@main
-      with:
-        image-path: ${{ github.sha }}
-        format: sarif
-        output: clair_results.sarif
-
-    - name: Upload sarif
-      uses: github/codeql-action/upload-sarif@v2
+          GIT_BRANCH='refs/tags/0.0.0' docker buildx bake --set release.output='type=docker' --set release.tags='od-official-server:${{ github.sha }}'
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@v0.36.0
       with:
-        sarif_file: clair_results.sarif
+        image-ref: 'od-official-server:${{ github.sha }}'
+        format: 'table'
+        exit-code: '1'
+        ignore-unfixed: true
+        vuln-type: 'os,library'
+        severity: 'CRITICAL,HIGH'

From db2e369af85c2599dedb3edda0511721bdf53597 Mon Sep 17 00:00:00 2001
From: Ana Alexandru-Gabriel <alexandru.ana@nokia.com>
Date: Tue, 23 Jun 2026 13:44:14 +0300
Subject: [PATCH 3/3] enable trivy in main branch

---
 .github/workflows/docker.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index e9614ac..f9bf718 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -2,13 +2,14 @@ name: Check Docker image builds
 on:
   pull_request:
     branches: [ "main" ]
+  push:
+    branches: [ "main" ]
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
     services:
       docker: