feat: OPS-11657 dev container generation

[mjuergens-cg]

Description

Links to Tickets or other PRs

Notes

Approval for review

• All points were discussed with the ticket creator, support-team or product owner. The code upholds all quality guidelines from the PR-template.

Notice: Please remove the WIP label if the PR is ready to review, otherwise nobody will review it.

[Copilot]

Pull request overview

This PR extends the reusable image publish workflow to optionally build/push devcontainers, and updates the Trivy/ClamAV scanning workflows to better support pulling images from GHCR (including authentication).

Changes:

• Added a build_type input to switch between standard container builds and devcontainers/ci builds.
• Changed downstream scanning to reference the pushed image by tag (instead of digest) and surfaced a tag output from the build job.
• Added GHCR authentication support for Trivy and ClamAV image pulls.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/image-publish-trivy.yaml	Adds build_type support and devcontainer build path; changes scan image references and workflow-call refs.
.github/workflows/check-trivy.yaml	Provides GHCR credentials to Trivy via env vars.
.github/workflows/check-image-clamav.yaml	Logs into GHCR before pulling/exporting the image for ClamAV scanning.

Suppressed comments (3)

.github/workflows/image-publish-trivy.yaml:228

• docker/metadata-action does not provide tag-names, and devcontainers/ci typically expects tag values (not full image refs). Use the metadata action’s single-tag version output and append latest only when requested.

          configFile: ${{ inputs.context }}/devcontainer.json
          imageName: ${{ steps.extract-image-name.outputs.image-name }}
          cacheFrom: ${{ steps.extract-image-name.outputs.image-name }}
          imageTag: ${{ steps.docker_meta_img.outputs.tag-names }},latest
          push: always

.github/workflows/image-publish-trivy.yaml:218

• DOCKER_METADATA_OUTPUT_TAGS can contain multiple tags (often newline-separated). Using %%:* on the whole string can produce a multi-line/invalid image-name value. Extract a single tag line first, then strip the tag suffix.

      - name: Extract image name
        id: extract-image-name
        if: ${{ inputs.build_type == 'devcontainer' }}
        run: |
          echo "image-name=${DOCKER_METADATA_OUTPUT_TAGS%%:*}" >> "$GITHUB_OUTPUT"

.github/workflows/image-publish-trivy.yaml:270

• Reusable workflows should be pinned to a stable ref (tag/SHA) or referenced locally. Using a feature-branch ref like @OPS-11657 will break consumers once the branch is gone and makes runs non-reproducible.

    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-image-clamav.yaml@OPS-11657

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.