Story (Required)

We need to setup a security vulnerability scan for PRs to keep track of any potential CVEs to be able to spot them and fix them early.

Background (Required)

_Recently a security vulnerability has been found in SBO v1.1.0 release only after the SBO was released and pushed to Operathohub.io and ArtifactHub. We missed that and SBO was released with it.

Approach(Required)

Add GitHub action to run aquasecurity/trivy-action action for scanning the operator image built by GH actions for HIGH or CRITICAL vulnerabilities for both PR and push-to-master workflows.

Acceptance Criteria

<Provides a required and minimum list of acceptance tests for this story. More is expected as the engineer implements this story>
GH actions are setup for running a security scan on PRs
GH actions are setup for running a security scan on master

INVEST Checklist

Dependencies identified
Blockers noted and expected delivery timelines set
Design is implementable
Acceptance criteria agreed upon
Story estimated

Legend

Unknown
Verified
Unsatisfied