Run the image vulnerability scan on a weekly schedule (#30)

* Run the image vulnerability scan on a weekly schedule

The Trivy scan added in #29 only ran against changed code (PRs and
pushes), so a CVE disclosed against an otherwise unchanged base image
would go unnoticed until the next actual change. Add a weekly cron
trigger, matching Dependabot's cadence in .github/dependabot.yml.

The push job's existing `if: github.event_name == 'push'` guard means
a schedule-triggered run builds and scans but never publishes.

* Add workflow_dispatch so the scan can be run on demand

Copilot review on PR #30 suggested this: waiting for the Monday cron
to validate a fix is unnecessary friction. workflow_dispatch has no
inputs, so it just re-runs the same build/test/scan on demand; the
push job's event_name guard still keeps it from publishing.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

.github/workflows/docker-publish.yml

@@ -9,6 +9,14 @@ on:
 
   pull_request:
 
+  # Catch newly disclosed CVEs against unchanged code; matches Dependabot's
+  # weekly cadence in .github/dependabot.yml.
+  schedule:
+    - cron: '0 6 * * 1'
+
+  # Run the scan on demand instead of waiting for the next cron tick.
+  workflow_dispatch:
+
 permissions:
   contents: read
 

IMPROVEMENTS.md

@@ -212,10 +212,12 @@ Acceptance criteria:
   Dependabot configuration covers `requirements.txt`, the Dockerfile base
   image, and the workflow actions. The Seafile AppImage is fetched by URL and
   checksum, so it still has to be bumped by hand.
-- [ ] Run dependency and image scans on pull requests and on a schedule. The
+- [x] Run dependency and image scans on pull requests and on a schedule. The
-  `test` job now runs the Trivy image scan on every pull request and on every
+  `test` job runs the Trivy image scan on every pull request, on every push
-  push to `master` or a tag (see P0), which covers new code; a scheduled run
+  to `master` or a tag, and now weekly (`schedule: cron '0 6 * * 1'`,
-  to catch newly disclosed CVEs against unchanged code is still missing.
+  matching Dependabot's cadence) to catch newly disclosed CVEs against
+  unchanged code. Dependency updates themselves are Dependabot's job; see
+  "CI and release pipeline" above.
 
 Acceptance criteria: