Vulnerability scanning is scheduled for CDE infrastructure

PCI-DSS 4.0 Req 11.3 requires that vulnerabilities in system components are identified and addressed via a vulnerability management program; Req 6.3 requires that security vulnerabilities are identified and ranked by risk. Without automated scheduled scanning, a critical CVE in an npm dependency or a container base image can linger for months before anyone notices. SLSA L2 requires build provenance and dependency tracking. CWE-1357 (Reliance on Uncontrolled Component) is exploitable whenever a dependency with a known CVE is in the production dependency tree and no process monitors for it.

Configure at least one automated vulnerability scanner on a weekly or daily schedule in CI/CD — manual npm audit runs don't satisfy PCI-DSS 4.0 Req 11.3 because they are not continuous. Use both Dependabot for dependency updates and Trivy for container/filesystem scanning.

# .github/workflows/security-scan.yml
on:
  schedule:
    - cron: '0 2 * * 0'  # Weekly Sunday 02:00 UTC
  push:
    branches: [main]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          format: sarif
          output: trivy-results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

Also add .github/dependabot.yml with interval: weekly so dependency PRs are opened automatically — the scanner finds issues; Dependabot fixes them.