test: add docker scout #1

	---
	name: Docker Scout

	on:
	pull_request:
	branches:
	- main
	push:
	branches:
	- 'main'
	workflow_dispatch:

	jobs:
	setup-matrix:
	runs-on: ubuntu-latest
	outputs:
	matrix: ${{ steps.set-matrix.outputs.matrix }}
	steps:
	- name: Source checkout
	uses: actions/checkout@v4

	- id: set-matrix
	run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT

	build_test_container:
	name: 'Build test container'
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write
	pull-requests: write
	needs: setup-matrix
	strategy:
	matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
	steps:
	- name: Login to Docker Hub
	uses: docker/login-action@v3
	with:
	username: voxpupulibot
	password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}

	- name: Analyze container image for CVEs
	id: analyze-image-cves
	uses: docker/scout-action@v1
	with:
	command: cves
	image: 'local://ci/voxbox:${{ matrix.rubygem_puppet }}'
	sarif-file: sarif.output.${{ matrix.rubygem_puppet }}.${{ github.sha }}.json
	write-comment: false

	- name: Compare container image to latest from Registry
	id: compare-image
	uses: docker/scout-action@v1
	with:
	command: compare
	image: 'local://ci/voxbox:${{ matrix.rubygem_puppet }}'
	to: 'ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-main'
	summary: true
	keep-previous-comments: true

	- name: Upload SARIF result
	id: upload-sarif
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: sarif.output.${{ matrix.rubygem_puppet }}.${{ github.sha }}.json

Provide feedback