[CI] Add separate Trivy workflow (trivy-scan.yml)

.github/workflows/ci-pr.yml

@@ -100,7 +100,16 @@ jobs:
           scan-type: 'fs'
           ignore-unfixed: true
           format: 'table'
+          output: 'trivy-results.txt'
           severity: 'CRITICAL,HIGH'
+          exit-code: 1
+      - name: Upload Trivy scan results
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: trivy-results
+          path: 'trivy-results.txt'
+          retention-days: 3
       - name: 'Scanned'
         shell: bash
         run: echo "::info ::Scanned"

.github/workflows/trivy-scan.yml

@@ -0,0 +1,32 @@
+name: Trivy Vulnerability Scan (Repo mode)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  run_trivy_scan:
+    name: Run Trivy Scan
+    runs-on: ubuntu-latest
+    if: github.repository == 'spring-projects/spring-pulsar'
+    steps:
+      - uses: actions/checkout@v3
+      - uses: spring-io/spring-gradle-build-action@v2
+      - name: Build
+        run: |
+          ./gradlew clean build -x integrationTest -x test
+      - name: Run Trivy scan in repo mode
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'table'
+          output: 'trivy-results.txt'
+          severity: 'CRITICAL,HIGH'
+          exit-code: 1
+      - name: Upload Trivy scan results
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: trivy-results
+          path: 'trivy-results.txt'
+          retention-days: 3