* Run the image vulnerability scan on a weekly schedule
The Trivy scan added in #29 only ran against changed code (PRs and
pushes), so a CVE disclosed against an otherwise unchanged base image
would go unnoticed until the next actual change. Add a weekly cron
trigger, matching Dependabot's cadence in .github/dependabot.yml.
The push job's existing `if: github.event_name == 'push'` guard means
a schedule-triggered run builds and scans but never publishes.
* Add workflow_dispatch so the scan can be run on demand
Copilot review on PR #30 suggested this: waiting for the Monday cron
to validate a fix is unnecessary friction. workflow_dispatch has no
inputs, so it just re-runs the same build/test/scan on demand; the
push job's event_name guard still keeps it from publishing.
---------
Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>
Maksim ShulgaandMaxim Shulga
b0dfc1ad74