Fix security vulnerabilities and add early dependency scanning

- Add apk upgrade to nginx:alpine to fix libpng vulnerabilities
- Add scan-deps job that runs in parallel with lint

.github/workflows/deploy.yml

@@ -35,13 +35,37 @@ jobs:
       - name: Run linter
         run: npm run lint
 
+  # ============================================================
+  # Dependency Scan Job - Runs in parallel with lint
+  # ============================================================
+  scan-deps:
+    name: Scan Dependencies
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.58.0
+
+      - name: Scan dependencies for vulnerabilities
+        run: |
+          trivy fs \
+            --exit-code 1 \
+            --ignore-unfixed \
+            --severity CRITICAL,HIGH \
+            --scanners vuln \
+            .
+
   # ============================================================
   # Build & Push Job - Build image and push to Harbor
   # ============================================================
   build:
     name: Build & Push Image
     runs-on: ubuntu-latest
-    needs: lint
+    needs: [lint, scan-deps]
     if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
 
     outputs:

Dockerfile

@@ -18,6 +18,9 @@ RUN npm run build
 # Production stage
 FROM nginx:alpine
 
+# Update Alpine packages to fix security vulnerabilities
+RUN apk upgrade --no-cache
+
 # Copy built app to nginx
 COPY --from=build /app/dist /usr/share/nginx/html