fix(ci): scan local image instead of pulling

[danbarr]

Problem

The Trivy scan was failing because it was trying to pull images from the remote registry (ghcr.io), which don't exist yet during the build process - especially for PRs where images aren't pushed.

Multi-platform Docker builds with Buildx don't load images into the local Docker daemon by design, causing Trivy to attempt a remote pull that fails with MANIFEST_UNKNOWN.

Solution

• Add a dedicated single-platform build step that uses load: true to load the image into the local Docker daemon
• Configure Trivy to scan the locally-loaded image using a local-scan: tag
• Reuse cached layers from the multi-platform build for efficiency

This works for both PRs (where images aren't pushed) and main branch builds (where they are), since Trivy now always scans the locally-available image.

Fixes #214

[Copilot]

Pull request overview

This PR fixes a Trivy security scanning failure in the CI pipeline by ensuring the scanner uses locally-built images instead of attempting to pull from the remote registry, which would fail for PRs where images aren't pushed.

Key Changes:

• Added a dedicated single-platform build step that loads the image into the local Docker daemon
• Updated Trivy scanner configuration to reference the locally-loaded image
• Leveraged build cache from the multi-platform build for efficiency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[rdimitrov]

Left a small comment but lgtm 💯