Allow the user to use custom signing scheme and multiple keys in vtxo tree signatures #590

	name: Trivy Security Scan

	on:
	push:
	branches: ["master"]
	pull_request:
	branches: ["master"]

	jobs:
	build:
	name: Build and Scan
	runs-on: ubuntu-20.04
	steps:
	- name: Checkout code
	uses: actions/checkout@v2

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v1

	- name: Build an image from Dockerfile
	uses: docker/build-push-action@v2
	with:
	context: .
	load: true
	tags: ${{ github.repository }}:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/[email protected]
	env:
	# avoid GHCR rate limits, see https://github.com/aquasecurity/trivy-db/pull/440 and https://github.com/aquasecurity/trivy-action/issues/389
	TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
	with:
	image-ref: "${{ github.repository }}:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	vuln-type: "os,library"
	severity: "CRITICAL,HIGH"

Provide feedback