add docker/scout-action

[jakoch]

• add docker/scout-action
  • compare? the local image is build and loaded and compared against the one pushed to the registry?
• upload sarif?

- name: Docker Scout
  id: docker-scout
  uses: docker/scout-action@v1 # https://github.com/docker/scout-action
  with:
    command: cves,recommendations,compare
    to-latest: false
    to: ${{ IMAGE }}:${{ COMPARE_TAG }}
    image: ${{ IMAGE }}:${{ IMAGE_TAG }}
    ignore-base: true
    ignore-unchanged: true
    only-fixed: ${{ ONLY-FIXED }}

    do we need to write comment, this requires token?
    write-comment: ${{ WRITE-COMMENT }}
    github-token: ${{ secrets.TOKEN }}

    do we need to upload sarif???
    sarif-file: sarif.output.json
    summary: true

- name: Upload Scan Report as Artifact
  uses: actions/upload-artifact@v4
  with:
    name: vulnerability-scan-report
    path: sarif.output.json

[jakoch]

Error: could not authenticate: user githubactions not entitled to use Docker Scout

this might need an additional auth to the docker-hub and not just the github token
see docker/scout-action#8

disabled for now