Add Docker Image Vulnerability Scanning (Trivy) to CI Pipeline

[hardikkaurani]

🟢 Good First Issue

Problem

The Docker build CI job does not scan built images for known CVEs or package vulnerabilities.

Why It Matters

Automated vulnerability scanning catches critical security issues before production deployment, reducing supply chain attack surface.

Suggested Files

• .github/workflows/ci.yml

Definition of Done

• Trivy or Grype scanner step added after docker compose build in CI.
• Scanner configured to fail on HIGH/CRITICAL severity CVEs.
• All existing CI jobs remain green.

[hardikkaurani]

👋 Maintainer Solution Guide:

1. Open .github/workflows/ci.yml
2. Add a Trivy scan step after docker compose build:
   `yaml

• name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
  image-ref: evalforge-backend:latest
  severity: HIGH,CRITICAL
  exit-code: 1
  `

3. Test by triggering a CI run on a feature branch first

DevOps-focused contribution — great for security-minded developers! 🔒