[swibi-ttd]

Summary

• retain the existing repository filesystem vulnerability scan
• add an image-scan matrix for all 14 Docker images published by the release workflow
• use the same Dockerfile/build-context pairs as release and disable fail-fast so every image is checked
• surface failures through the workflow result only; the scheduled workflow summary handles Slack notification

Context

The filesystem scan passed on the runtime-dependencies branch, but the publish-time image scan in run 35184808998 found vulnerabilities in the Node/Alpine base image and globally bundled npm packages. Those dependencies are not visible in repository lockfile scans.

Jira: UID2-7877

Validation

• actionlint .github/workflows/vulnerability-scan-failure-notify.yaml
• git diff --check
• compared the image-scan matrix against release-all-docker-images.yaml; all Dockerfile/context pairs match

No direct Slack action or webhook is used by this workflow.