ci: add Trivy image scanning for runtime images

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -25,6 +25,7 @@ workflow:
 
 stages:
   - prepare
+  - scan
   - test
   - compile
   - train
@@ -251,6 +252,56 @@ build-foxhunt-training-runtime:
       --cache=true --cache-repo="${REGISTRY}/cache"
       --destination "${REGISTRY}/foxhunt-training-runtime:latest"
 
+# --------------------------------------------------------------------------
+# Stage 0.5: Scan runtime images for vulnerabilities (Trivy)
+# --------------------------------------------------------------------------
+scan-runtime-images:
+  stage: scan
+  image:
+    name: aquasec/trivy:latest
+    entrypoint: [""]
+  tags:
+    - kapsule
+    - docker
+  variables:
+    KUBERNETES_CPU_REQUEST: "200m"
+    KUBERNETES_CPU_LIMIT: "500m"
+    KUBERNETES_MEMORY_REQUEST: "256Mi"
+    KUBERNETES_MEMORY_LIMIT: "512Mi"
+  needs:
+    - job: build-foxhunt-runtime
+      optional: true
+    - job: build-foxhunt-training-runtime
+      optional: true
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"
+    - if: $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "api"
+  cache:
+    key: trivy-db
+    paths:
+      - .trivy-cache/
+  before_script:
+    - export TRIVY_USERNAME=nologin
+    - export TRIVY_PASSWORD=${SCW_SECRET_KEY}
+  script:
+    - echo "Scanning runtime images for CRITICAL/HIGH vulnerabilities..."
+    - trivy image
+      --cache-dir .trivy-cache
+      --exit-code 1
+      --severity CRITICAL,HIGH
+      --ignore-unfixed
+      --no-progress
+      "${REGISTRY}/foxhunt-runtime:latest"
+    - trivy image
+      --cache-dir .trivy-cache
+      --exit-code 1
+      --severity CRITICAL,HIGH
+      --ignore-unfixed
+      --no-progress
+      "${REGISTRY}/foxhunt-training-runtime:latest"
+    - echo "Image scan passed — no fixable CRITICAL/HIGH vulnerabilities."
+  allow_failure: false
+
 
 # Base template for Rust jobs — pre-baked CI builder from Scaleway CR
 # Image pre-exists in SCR; rebuild via build-ci-builder when Dockerfile changes