An image scanned on a schedule rather than on a build

Scanning at build time answers whether the image was vulnerable when it was built, which is not the question anybody asks.

on:
  schedule: [{ cron: '0 5 * * *' }]

jobs:
  scan-running:
    steps:
      - run: |
          for tag in $(./bin/deployed-image-tags); do
            trivy image --severity HIGH,CRITICAL 
              --exit-code 1 "$tag" || failed=1
          done
          [ -z "${failed:-}" ]

A vulnerability disclosed after a build is invisible to a build-time scan, and an image that has been running for three weeks is exactly the one that has accumulated the most. Scanning what is deployed rather than what is built changes the finding rate from about one a month to about one a week, all of them actionable.