Scan the published image for known vulnerabilities

terdut-server was the only one of the three release-managed repos with no
image scanning at all. riksdata and rd-web have had a scan-image job since
they were set up; everything published here up to and including v0.9.3 went
out without a CVE check.

It scans the pushed image rather than a locally built one, for the same
reason the siblings do: trivy cannot read a local image on this runner,
since Talos has no docker socket and the dind sidecar shares no filesystem
with the job. So it runs after image rather than gating it, and a red scan
unpublishes nothing. What it means is narrower and worth stating plainly: do
not bump the wrapper chart in Ryuvia/charts to that version.

Checked before wiring it in rather than after. v0.9.3 scans clean at
HIGH,CRITICAL with unfixed findings ignored, so this does not turn the
pipeline red on arrival, and the same command exits 1 on an image that does
have findings — a gate that cannot fail is not a gate.

One platform is scanned, not both. The image is FROM scratch, so there are
no OS packages and trivy sees a single target: the Go binary and its module
graph. linux/amd64 and linux/arm64 are that same module set built for a
different GOARCH, so a finding in one is a finding in both. On an image with
a base layer that reasoning would not hold.

Still no govulncheck and no gitleaks here, which riksdata and rd-web run in
a separate CI job. This is the only security scanning terdut-server has.

Claude-Session: https://claude.ai/code/session_01S7R4gWTz5wh5xCY4nCSJjN

CLAUDE.md

@@ -16,9 +16,11 @@ Config is `.release.conf` here plus `make release-vars`. The process itself live
 
 Two things about this repo specifically:
 
-- **The pipeline has no image scan.** `.gitea/workflows/release.yaml` runs `test`,
-  `binaries`, `image` and `chart`. A green release run is not evidence the image is
-  CVE-clean, and a release note must not imply it is.
+- **The image is scanned after it is published, not before.** `scan-image` runs trivy
+  against the pushed image, because trivy cannot read a locally built one on this runner.
+  A red scan therefore unpublishes nothing — it means: do not bump the wrapper chart in
+  `Ryuvia/charts` to this version. Added 2026-09-02; every release up to and including
+  v0.9.3 was published with no CVE check at all.
 - **The wrapper chart has two `tag:` lines** — the app image and the python backup sidecar —
   so `chart-bump` needs `--image "$IMAGE"` to know which one moves.