add trivy ignore, test pipeline

.github/workflows/publish.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
     - 'main'
+    - 'devops/add-docker-security-r3'
     tags:
     - '*'
 
@@ -18,8 +19,13 @@ jobs:
       run-lint: true
 
   docker_pipeline:
-    needs: ["lint_test"]
-    uses: babylonlabs-io/.github/.github/workflows/[email protected]
+    uses: babylonlabs-io/.github/.github/workflows/reusable_docker_pipeline.yml@huy/add-docker-sec
+    permissions:
+      # required for all workflows
+      security-events: write
+      # required to fetch internal or private CodeQL packs
+      packages: read
     secrets: inherit
     with:
       publish: true
+      docker_scan: true

.trivyignore.yaml

@@ -0,0 +1,6 @@
+
+vulnerabilities:
+- id: CVE-2024-27304
+  statement: Not using the function. Ignored.
+- id: GHSA-7jwh-3vrq-q3m8
+  statement: Not using the function. Ignored.