Ensure Images are Scanned and Rebuilt (CIS 4.4)

# Vulnerable CI/CD Pipeline (No Scanning)
# This pipeline builds and pushes the image blindly.
# If the base image 'node:14' has a new critical vulnerability,
# it will be pushed to production immediately.
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Build Docker Image
        run: docker build -t myapp:latest .
      - name: Push to Registry
        run: docker push myapp:latest

# Secure CI/CD Pipeline (Automated Scanning)
# This pipeline fails the build if critical vulnerabilities are found.
jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Build Docker Image
        run: docker build -t myapp:latest .
      
      # Remediation: Run an image vulnerability assessment tool
      - name: Scan Image for Vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:latest'
          format: 'table'
          exit-code: '1'        # Fail the pipeline if issues are found
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'

      - name: Push to Registry
        if: success()  # Only push if the scan passed
        run: docker push myapp:latest

docker ps --quiet

# Example using Trivy to scan an image manually
trivy image <IMAGE_ID>