ci: move trivy image scan to separate ubuntu-latest job to avoid self-hosted timeout

.github/workflows/release.yml

@@ -41,7 +41,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      security-events: write  # for uploading SARIF to GitHub Security tab
 
     strategy:
       fail-fast: false
@@ -103,19 +102,44 @@ jobs:
           cache-from: type=gha,scope=${{ matrix.name }}
           cache-to: type=gha,mode=max,scope=${{ matrix.name }}
 
+  scan:
+    name: Scan (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    needs: build-docker
+    permissions:
+      contents: read
+      packages: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: alpine
+            suffix: ""
+          - name: astra
+            suffix: "-astra"
+          - name: redos
+            suffix: "-redos"
+
+    steps:
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       # ── CVE scan of the pushed image ────────────────────────────────────────
-      - name: Trivy — image scan
+      - name: Trivy — image scan (${{ matrix.name }})
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: image
-          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}${{ matrix.suffix }}
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}${{ matrix.suffix }}
           format: sarif
           output: trivy-image-${{ matrix.name }}.sarif
           severity: HIGH,CRITICAL
           exit-code: 0  # warn only; change to 1 to block on vulnerabilities
-        env:
-          TRIVY_USERNAME: ${{ github.actor }}
-          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy image results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
@@ -127,7 +151,7 @@ jobs:
   release:
     name: GitHub Release
     runs-on: ubuntu-latest
-    needs: build-docker
+    needs: [build-docker, scan]
     permissions:
       contents: write
       packages: read  # to pull image for SBOM generation