WIP run trivy from makefile

Makefile

@@ -31,6 +31,9 @@ else
 TAR := tar
 endif
 
+# trivy vulnerability checker version, https://github.com/aquasecurity/trivy/releases
+TRIVY_VERSION=0.38.3
+
 code_sniffer:
 	@$(PHPCS)
 
@@ -82,6 +85,9 @@ locale_test_%:
 		--bootstrap tests/languages/bootstrap.php \
 		--testsuite language-$(firstword $(subst _, ,$*))
 
+test_trivy:
+	wget --continue -O trivy_$(TRIVY_VERSION)_Linux-64bit.tar.gz https://github.com/aquasecurity/trivy/releases/download/v$(TRIVY_VERSION)/trivy_$(TRIVY_VERSION)_Linux-64bit.tar.gz
+
 all_tests: test locale_test_de_DE locale_test_en_US locale_test_fr_FR
 	@# --The current version is not compatible with PHP 7.2
 	@#$(BIN)/phpcov merge --html coverage coverage
@@ -146,8 +152,8 @@ release_zip: composer_dependencies htmldoc translate build_frontend
 
 ### remove all unversioned files
 clean:
-	@git clean -df
-	@rm -rf sandbox
+	@git clean -dfx
+	@rm -rf sandbox vendor
 
 ### generate the AUTHORS file from Git commit information
 generate_authors: