add trivy workflow to scan repo as IaC

.github/workflows/trivy.yaml

@@ -0,0 +1,24 @@
+name: Trivy
+on:
+  push:
+    branches:
+      - development
+  pull_request:
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Run Trivy vulnerability scanner in IaC mode
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'config'
+          trivy-config: '.trivy-config.yaml'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'

.trivy-config.yaml

@@ -0,0 +1,25 @@
+timeout: 10m
+format: sarif
+dependency-tree: true
+list-all-pkgs: true
+exit-code: 0
+output: 'trivy-results.sarif'
+ignore-unfixed: true
+severity:
+  - HIGH
+  - CRITICAL
+scan:
+  security-checks:
+      scanners:
+        - vuln
+        - misconfig
+        - secret
+        - license
+
+vulnerability:
+  type:
+    - os
+    - library
+  ignore-unfixed: true
+db:
+  skip-update: false