[DSEC-936] more zap logging; use google cloud logging #1625

	name: dsp-appsec-trivy
	on:
	pull_request:
	# schedule:
	# - cron: '0 14 * * 1' # each Monday at 9am EST

	jobs:
	appsec-trivy:
	# Parse Dockerfile and build, scan image if a "blessed" base image is not used
	name: DSP AppSec Trivy check
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	include:
	- dir: batch
	- dir: bastion
	- dir: cis
	- dir: sdarq/frontend
	- dockerfile: sdarq/backend/Dockerfile
	- dir: zap
	env:
	SARIF_PATH: ${{ matrix.dir }}/trivy-results.sarif

	steps:
	- uses: actions/checkout@v4

	- uses: broadinstitute/dsp-appsec-trivy-action@v1
	with:
	context: ${{ matrix.dir \|\| '.' }}
	dockerfile: ${{ matrix.dockerfile \|\| 'Dockerfile' }}
	severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
	# sarif: ${{ !github.base_ref && env.SARIF_PATH \|\| '' }}

	# NOTE: this functionality is limited to public repos only;
	# TODO: uncomment the Cron schedule and Sarif config when made public
	# - name: Upload Trivy scan results to GitHub Security tab
	# uses: github/codeql-action/upload-sarif@v1
	# if: ${{ !github.base_ref }} # omit upload on PRs
	# with:
	# sarif_file: ${{ env.SARIF_PATH }}

Provide feedback