Security workflow refactoring

.github/workflows/security.yml

@@ -4,11 +4,10 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
-  security-events: write
-  actions: read
 
 jobs:
   secrets:
@@ -21,11 +20,27 @@ jobs:
   trivy:
     name: Vulnerability and IaC Scan - Trivy
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/cache@v4
+        with:
+          path: .trivy-cache
+          key: trivy-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: trivy-${{ runner.os }}-
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
         with:
           scan-type: fs
           scan-ref: .
           exit-code: 1
           severity: CRITICAL,HIGH
+          format: sarif
+          output: trivy.sarif
+          cache-dir: .trivy-cache
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy.sarif