Test trivy with tar output.

.gitea/workflows/release.yml

@@ -43,5 +43,12 @@ jobs:
         with:
           tags: cs-git.ddnss.de/ri-st/startup:latest
           push: true
-#          cache-from: type=gha
+          outputs: type=docker,dest=/tmp/startup.tar
-#          cache-to: type=gha,mode=max
+
+      - name: Check with trivy
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-ref: '/tmp/startup.tar'
+          scan-type: 'fs'
+          format: 'table'
+          vuln-type: 'os,library'