Add npm audit to pipelines. Add trivy scan to release.

.github/workflows/main-deploy.yml

@@ -21,6 +21,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Security audit
+        run: npm audit --audit-level=high
+
       - name: Run type checking
         run: npm run check
 

.github/workflows/pr-checks.yml

@@ -21,6 +21,10 @@ jobs:
 
       - name: Install dependencies
         run: npm ci
+
+      - name: Security audit
+        run: npm audit --audit-level=high
+
       - name: Run linting
         run: npm run lint
   check:

.github/workflows/release.yml

@@ -62,7 +62,20 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push Docker images
+      - name: Build Docker image
+        run: docker build -t openreception/open-reception:${{ github.ref_name }} .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "openreception/open-reception:${{ github.ref_name }}"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
+
+      - name: Push Docker images
         run: npm run docker:build-and-push
 
       - name: Create Release Archive