Merge pull request 'fix(ci): use ghcr.io mirror for Trivy DB to avoid mirror.gcr.io DNS failures' (#759) from fix/ci-prisma-generate into main

mirror.gcr.io intermittently fails DNS resolution in CI runner environment.
Add --db-repository ghcr.io/aquasecurity/trivy-db to all three Trivy scan steps
as a reliable alternative to the default GCR mirror.

Fixes pipeline #1056 failure (security-trivy-api/orchestrator/web all failed
with: 'dial tcp: lookup mirror.gcr.io on 127.0.0.11:53: server misbehaving')

.woodpecker/ci.yml

@@ -243,7 +243,7 @@ steps:
         if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-api:$$SCAN_TAG
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore --db-repository ghcr.io/aquasecurity/trivy-db git.mosaicstack.dev/mosaic/stack-api:$$SCAN_TAG
     when:
       - branch: [main]
         event: [push, manual, tag]
@@ -264,7 +264,7 @@ steps:
         if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-orchestrator:$$SCAN_TAG
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore --db-repository ghcr.io/aquasecurity/trivy-db git.mosaicstack.dev/mosaic/stack-orchestrator:$$SCAN_TAG
     when:
       - branch: [main]
         event: [push, manual, tag]
@@ -305,7 +305,7 @@ steps:
         if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-web:$$SCAN_TAG
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore --db-repository ghcr.io/aquasecurity/trivy-db git.mosaicstack.dev/mosaic/stack-web:$$SCAN_TAG
     when:
       - branch: [main]
         event: [push, manual, tag]