trivy_periodic_image_scan.yml

---
#
# This workflow scans the published container images
# for new vulnerabilities daily, publishing findings.
# Findings will be associated with the 'main' branch
# of the repo' in the GitHub Security tab.
#
name: Trivy Periodic Image Scan

on:
  schedule:
    # run daily
    - cron: "0 0 * * *"

jobs:
  trivy:
    name: trivy-periodic-scan
    uses: "./.github/workflows/trivy.yml"
    with:
      SOURCE_TYPE: image
      IMAGE_NAME: ghcr.io/${{ github.repository }}:main
...