add trivy scan to docker

Signed-off-by: Jan Jansen <[email protected]>

.github/workflows/ci-release.yml

@@ -89,6 +89,21 @@ jobs:
         with:
           name: distribution-builds
           path: janusgraph-dist/target/janusgraph-*.zip
+      - name: Set JanusGraph version environment variable
+        run: |
+          export JG_VER="$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)-$(git rev-parse --short HEAD)"
+          echo "JG_VER=${JG_VER}" >> $GITHUB_ENV
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'ghcr.io/janusgraph/janusgraph:${{ env.JG_VER }}'
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
+          output: 'trivy-results.sarif'
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'
 
   tp-tests:
     runs-on: ubuntu-22.04