[CI] Fix trivy standalone workflow

.github/trivy.yaml

@@ -0,0 +1,19 @@
+scan:
+  scanners:
+    - vuln
+  file-patterns:
+    - 'pom:.*\.pom'
+
+severity:
+  - CRITICAL
+  - HIGH
+
+vulnerability:
+  ignore-unfixed: true
+
+# format: json
+# output: trivy-results.json
+
+exit-code: 1
+timeout: 10m
+debug: false

.github/workflows/trivy-scan.yml

@@ -7,26 +7,30 @@ jobs:
   run_trivy_scan:
     name: Run Trivy Scan
     runs-on: ubuntu-latest
-    if: github.repository == 'spring-projects/spring-pulsar'
+    env:
+      LOCAL_REPOSITORY_PATH: ./build/publications/repos
     steps:
       - uses: actions/checkout@v3
       - uses: spring-io/spring-gradle-build-action@v2
-      - name: Build
+      - name: Publish to local repo (poms)
         run: |
-          ./gradlew clean build -x integrationTest -x test
+          ./gradlew publishMavenJavaPublicationToLocalRepository
       - name: Run Trivy scan in repo mode
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: 'fs'
-          ignore-unfixed: true
-          format: 'table'
-          output: 'trivy-results.txt'
-          severity: 'CRITICAL,HIGH'
-          exit-code: 1
-      - name: Upload Trivy scan results
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: trivy-results
-          path: 'trivy-results.txt'
-          retention-days: 3
+          scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
+          trivy-config: .github/trivy.yaml
+
+      # - name: Output Trivy scan results
+      #   if: always()
+      #   run: |
+      #     cat trivy-results.json
+
+      # - name: Upload Trivy scan results
+      #   uses: actions/upload-artifact@v3
+      #   if: always()
+      #   with:
+      #     name: trivy-results
+      #     path: trivy-results.json
+      #     retention-days: 3

trivy.yaml

@@ -1,4 +0,0 @@
-timeout: 10m
-scan:
-  security-checks:
-    - vuln