Fix security vulnerabilities and add early dependency scanning

- Update to node:20-alpine base image
- Add apk upgrade to fix OS-level vulnerabilities
- Update npm to latest to fix bundled package vulnerabilities
- Add scan-deps job that runs in parallel with tests
- Replace deprecated --only=production with --omit=dev

.github/workflows/deploy.yml

@@ -50,13 +50,37 @@ jobs:
           JWT_SECRET: test-jwt-secret-for-ci
           NODE_ENV: test
 
+  # ============================================================
+  # Dependency Scan Job - Runs in parallel with tests
+  # ============================================================
+  scan-deps:
+    name: Scan Dependencies
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.58.0
+
+      - name: Scan dependencies for vulnerabilities
+        run: |
+          trivy fs \
+            --exit-code 1 \
+            --ignore-unfixed \
+            --severity CRITICAL,HIGH \
+            --scanners vuln \
+            .
+
   # ============================================================
   # Build & Push Job - Build image and push to Harbor
   # ============================================================
   build:
     name: Build & Push Image
     runs-on: ubuntu-latest
-    needs: test
+    needs: [test, scan-deps]
     if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
 
     outputs:

Dockerfile

@@ -1,8 +1,12 @@
-FROM node:18-alpine
+FROM node:20-alpine
 
 # Set working directory
 WORKDIR /app
 
+# Update Alpine packages and npm to fix security vulnerabilities
+RUN apk upgrade --no-cache && \
+    npm install -g npm@latest
+
 # Install Curl
 RUN apk add --no-cache curl
 
@@ -10,7 +14,7 @@ RUN apk add --no-cache curl
 COPY package*.json ./
 
 # Install dependencies
-RUN npm ci --only=production
+RUN npm ci --omit=dev
 
 # Copy source code
 COPY . .