Migrate from Trivy to Docker scout

.github/workflows/docker-scan.yml

@@ -22,6 +22,7 @@ permissions:
   contents: read
   actions: read
   security-events: write
+  pull-requests: write  # Required for Docker Scout PR comments
 
 jobs:
   scan:
@@ -47,30 +48,28 @@ jobs:
           # Disable GitHub Actions cache for this workflow
           no-cache: true
 
-      - name: Run Trivy vulnerability scanner
+      - name: Docker Scout vulnerability scan
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: docker/scout-action@v1
         with:
-          image-ref: gitea-mirror:scan
+          command: cves
-          format: 'sarif'
+          image: gitea-mirror:scan
-          output: 'trivy-results.sarif'
+          sarif-file: scout-results.sarif
-          exit-code: '1'
+          summary: true
-          ignore-unfixed: false
+          exit-code: true
-          vuln-type: 'os,library'
+          only-severities: critical,high
-          severity: 'CRITICAL,HIGH'
+          write-comment: true
 
-      - name: Upload Trivy scan results to GitHub Security tab
+      - name: Upload Docker Scout scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
-          sarif_file: 'trivy-results.sarif'
+          sarif_file: scout-results.sarif
 
-      - name: Run Trivy vulnerability scanner (table output)
+      - name: Docker Scout policy evaluation
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: docker/scout-action@v1
-        if: failure()
+        if: always()
         with:
-          image-ref: gitea-mirror:scan
+          command: policy
-          format: 'table'
+          image: gitea-mirror:scan
-          exit-code: '0'
+          exit-code: false
-          ignore-unfixed: false
+          write-comment: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'