ci: add Trivy and Dive to PR workflow

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: miragecentury

.github/workflows/ci.yaml

@@ -30,7 +30,7 @@ jobs:
           dockerfile: Containerfile
 
   build:
-    name: Test build
+    name: Build and scan
     runs-on: ubuntu-latest
     needs: [hadolint]
     steps:
@@ -49,3 +49,28 @@ jobs:
           done
           # shellcheck disable=SC2086
           docker build -f Containerfile ${BUILD_ARGS} -t test-build .
+
+      - name: Install Dive
+        run: |
+          DIVE_VERSION=0.12.0
+          curl -sSL -o /tmp/dive.deb "https://github.com/wagoodman/dive/releases/download/v${DIVE_VERSION}/dive_${DIVE_VERSION}_linux_amd64.deb"
+          sudo apt install -y /tmp/dive.deb
+          rm /tmp/dive.deb
+
+      - name: Dive filesystem scan
+        run: dive --ci --source=docker test-build
+
+      - name: Cache Trivy vulnerability DB
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
+
+      - name: Trivy vulnerability scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: test-build
+          severity: 'HIGH,CRITICAL'
+          exit-code: '1'