CI/CD pipeline runs vulnerability scanning on every image build

Container images accumulate CVEs between builds — a base image pinned three months ago may carry critical kernel or libc vulnerabilities exploitable at runtime (NIST 800-53 SI-3, CWE-1357). Without automated scanning in CI/CD, vulnerable images reach production silently. SSDF 800-218 RV.1.3 requires continuous vulnerability monitoring of software components. CIS Docker 4.7 mandates scanning. A pipeline that scans but allows critical findings to pass with --exit-code 0 provides no protection — the gate must block deployment when high or critical CVEs are present.

Add Trivy to every image-building pipeline in .github/workflows/build.yml and block deployment on HIGH or CRITICAL findings:

- name: Scan image with Trivy
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.IMAGE }}:${{ env.TAG }}
    exit-code: '1'
    severity: 'HIGH,CRITICAL'
    format: 'table'

For Snyk users: snyk container test <image:tag> --severity-threshold=high --fail-on=all. The key requirement is exit-code: 1 (Trivy) or equivalent — without it, findings are logged but the pipeline succeeds and the vulnerable image ships.