fixup! ci(sdk): add trivy scan vuln final step

replace trivy with docekr scount

Author: endersonmaia

.github/workflows/sdk.yaml

@@ -110,6 +110,7 @@ jobs:
                       *.cache-from=type=gha
                       *.cache-to=type=gha,mode=max
                   push: true
+                  sbom: true
 
             - uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
             - name: Build and push (depot)
@@ -129,8 +130,9 @@ jobs:
                       ./docker-metadata-rollups-runtime/docker-metadata-action-bake.json
                       ./docker-metadata-rollups-database/docker-metadata-action-bake.json
                   push: true
+                  sbom: true
 
-    trivy:
+    scout:
         runs-on: ubuntu-latest
         needs:
             - build
@@ -143,61 +145,30 @@ jobs:
             packages: read
         name: trivy-${{ matrix.target }}
         steps:
-            - name: Download all docker-metadata artifacts
+            - name: Download bake metadata
               uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
               with:
-                  pattern: docker-metadata-*
-                  path: packages/sdk/
-
-            - name: Trivy Setup
-              uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.0
-              with:
-                cache: true
-                version: v0.69.1
-
-            - name: Collect image references
-              id: images
-              run: |
-                  set -euo pipefail
-
-                  mapfile -t IMAGES < <(
-                    jq -r '.. | .tags? // empty | .[]?' \
-                      packages/sdk/docker-metadata-${{ matrix.target }}/docker-metadata-action-bake.json \
-                      | awk 'NF > 0' \
-                      | sort -u
-                  )
-
-                  if [ "${#IMAGES[@]}" -eq 0 ]; then
-                    echo "No image tags found in docker metadata artifacts."
-                    exit 0
-                  fi
+                name: bake-metadata
 
-                  {
-                    echo "images<<EOF"
-                    printf '%s\n' "${IMAGES[@]}"
-                    echo "EOF"
-                  } >> "$GITHUB_OUTPUT"
-
-            - name: Scan images with Trivy
-              if: ${{ steps.images.outputs.images != '' }}
+            - name: Get image digest
+              id: image-ref
               run: |
-                  set -euo pipefail
-
-                  while IFS= read -r image; do
-                    [ -z "$image" ] && continue
-                    echo "Scanning $image"
-                    {
-                        echo "<details><summary><strong>Trivy image scan : ${{ matrix.target }} </strong></summary><pre lang="shell"><code>"
+                DIGEST=$(jq -r '."${{ matrix.target }}"["containerimage.digest"]' bake-metadata.json)
+                echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
-                        trivy image                     \
-                            --scanners vuln             \
-                            --format table              \
-                            --report summary            \
-                            --severity HIGH,CRITICAL    \
-                            --ignore-unfixed            \
-                            --exit-code 1               \
-                            "$image"
+            - name: Login to DockerHub
+              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-                        echo "</code></pre></details><hr>"
-                    } >> $GITHUB_STEP_SUMMARY
-                  done <<< "${{ steps.images.outputs.images }}"
+            - name: Docker Scout
+              id: docker-scout
+              if: ${{ github.event_name == 'pull_request' }}
+              uses: docker/scout-action@8910519cee8ac046f3ee99686b0dc6654d5ba1a7 # v1.20.3
+              with:
+                command: quickview,cves
+                image: ghcr.io/cartesi/${{ matrix.target }}@${{ steps.image-ref.outputs.digest }}
+                ignore-unchanged: true
+                only-severities: critical,high
+                github-token: ${{ secrets.GITHUB_TOKEN }}