Do security scanning in task step #8
Description
The setup-runtime-resource now by default scans for CVE's with https://github.com/anchore/grype. It will break when a critical CVE is found in the rootfs that will be used by the task step.
In the recommend security mode the rootfs security scanning should be moved to the task step. This will slow down builds since every build it will update the grype db and do the security scanning.
Doing this every build is safer (new CVE's) can be found in the meantime and although CVE exclusion can be added to the setup-runtime source config it requires a new setup-runtime get step and a fly set-pipeline.
Not sure if it would work well in practice but lets try...