From a1ed7cbae4ac13800ca89c446a6fb1db01e1a91c Mon Sep 17 00:00:00 2001
From: Zoheb Shaikh <26975142+ZohebShaikh@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:46:54 +0100
Subject: [PATCH 1/2] ci: add trivy scan to periodic workflow

---
 .github/workflows/_trivy.yml   | 35 ++++++++++++++++++++++++++++++++++
 .github/workflows/periodic.yml |  3 +++
 2 files changed, 38 insertions(+)
 create mode 100644 .github/workflows/_trivy.yml

diff --git a/.github/workflows/_trivy.yml b/.github/workflows/_trivy.yml
new file mode 100644
index 0000000000..e18423b274
--- /dev/null
+++ b/.github/workflows/_trivy.yml
@@ -0,0 +1,35 @@
+name: Trivy vulnerability scan
+
+on:
+  workflow_call:
+
+jobs:
+  scan_container:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and export to Docker local cache
+        uses: docker/build-push-action@v7
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          context: .
+          load: true
+          tags: tag_for_scanning
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: 'tag_for_scanning'
+          version: 'v0.74.0'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
diff --git a/.github/workflows/periodic.yml b/.github/workflows/periodic.yml
index 18b419c5f4..21541d9d3d 100644
--- a/.github/workflows/periodic.yml
+++ b/.github/workflows/periodic.yml
@@ -11,3 +11,6 @@ jobs:
     uses: ./.github/workflows/_tox.yml
     with:
       tox: docs -- -b linkcheck
+
+  trivy:
+    uses: ./.github/workflows/_trivy.yml

From 541290b3a3a4514ef7fc2ecd739246015f9f4788 Mon Sep 17 00:00:00 2001
From: Zoheb Shaikh <26975142+ZohebShaikh@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:06:18 +0100
Subject: [PATCH 2/2] tidy things

---
 .github/workflows/_trivy.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/_trivy.yml b/.github/workflows/_trivy.yml
index e18423b274..36af54e0f5 100644
--- a/.github/workflows/_trivy.yml
+++ b/.github/workflows/_trivy.yml
@@ -26,10 +26,9 @@ jobs:
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@v0.36.0
         with:
-          image-ref: 'tag_for_scanning'
-          version: 'v0.74.0'
-          format: 'table'
-          exit-code: '1'
+          image-ref: "tag_for_scanning"
+          version: "latest"
+          exit-code: "1"
           ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"