Add a step in the build pipeline to scan the grype/trivy results for issues

[jimmykarily]

Especially since the "Security" tab doesn't work very well.

[jimmykarily]

Added a step but unfortunately GitHub doesn't have a nice way to preset optional steps: actions/runner#2347

End result: it runs, it fails but it's not visible in the pipeline unless you click on it.

Also downloading the scan results from the pipeline artifacts, unzipping then an parsing them with a tool (e.g. sarif-tools) is a tedious job. Let's hope GitHub fixes the "Security" tab issue.

[jimmykarily]

Would be nice is we could use something like this: https://microsoft.github.io/sarif-web-component/

I'll do some research. Maybe there is an easy way to preset the scan results outside github.

Update: It's open source: https://github.com/microsoft/sarif-web-component
You can run it locally by xdg-open docs/index.html (from that repo)

[jimmykarily]

Scan results can be downloaded with one command:

gh run --repo kairos-io/kairos download 12867815838 --pattern "*scan-results.zip" -D results/

[jimmykarily]

Step was added. It's still not easy to consume but I don't see how it can be easily improved currently.