CI: run Trivy only when the Build job _actually_ ran

[paullatzelsperger]

WHAT

We need to modify our trivy.yaml job to run only when the build.yaml workflow has actually ran. Currently, the Trivy job is executed as soon as the Build job has completed.

WHY

Trivy scans the docker images for vulnerabilities, and it uses the Git SHA as Docker tag. However, Docker images are not produced during pull requests or on forks, so the Trivy job cannot resolve the docker image, and thus will always fail.

IMPLEMENTATION PROPOSAL

1. Option 1: prevent Trivy runs on pull requests
   simply add if: ${{ github.event_name != 'pull_request' }} to the git-sha7 job. That will not prevent it from running in forks!

2. Option 2: use repository_dispatch and define a custom event
   Check here

3. Option 3: upload custom data using workflow_run
   Check the official documentation

Personally I think Option 3 is the most elegant one, because it will allow us to send a boolean flag (and potentially more data) as event payload, that indicates whether docker images were actually produced or not.