ci: add workflow to enable automatic vulnerability reports

This re-usable workflow can be used for reporting security vulnerabilities
via Github issues. It takes the issue title, image-name, and issue-labels as
inputs, and in turn:
* edits an existing issue with the same title and updates the vulnerability report
* creates a new issue with the issue-title and adds the vulnerability report in the description

Please NOTE this workflow assumes the existence of vulnerability reports as artefacts
of a workflow run; that is, it expects artefacts named trivy-report-<image-name> to
be present in the sabe workflow run.

Part of #69

.github/workflows/report-vulnerability-in-gh.yaml

@@ -0,0 +1,78 @@
+name: Report vulnerability issues in Github
+on:
+  workflow_call:
+    inputs:
+      issue-title:
+        description: The title of the issue to be created/edited
+        required: true
+        type: string
+      issue-labels:
+        description: A comma separated list of labels
+        required: false
+        type: string
+        default: "bug"
+      image-name:
+        description: "Name of the oci-image as saved in Dockerhub or in the docker cache.
+          It consists of <rock-name>:<rock-version>."
+        required: true
+        type: string
+
+jobs:
+  report-vulns:
+    name: Create or edit issues for reporting vulnerabilities
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Install tools
+        run: |
+          sudo snap install gh
+          sudo snap install jq
+
+      - name: Generate image name
+        id: image-name
+        run: |
+          IMAGE_NAME=$(echo ${{ inputs.image-name }} | sed 's/\:/-/g')
+          echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Get issue number if exists
+        id: get-issue-number
+        run: |
+          export GH_TOKEN=${{ secrets.GH_TOKEN }}
+          EXPECTED_TITLE=$(echo "${{ inputs.issue-title }} ${{ inputs.image-name }}")
+          ISSUE_NUMBER=$(gh issue list --repo $GITHUB_REPOSITORY --limit 500 --json "number,title" | jq -r --arg expected_title "$EXPECTED_TITLE" '.[] | select(.title == $expected_title) | .number')
+          echo "issue-number=$ISSUE_NUMBER" >> $GITHUB_OUTPUT
+
+      - name: Download report
+        uses: actions/download-artifact@v4
+        with:
+          name: trivy-report-${{ steps.image-name.outputs.image-name }}
+
+      - name: Issue body
+        id: issue-body
+        run: |
+          set -xeu
+          EXPECTED_TITLE=$(echo "${{ inputs.issue-title }} ${{ inputs.image-name }}")
+          echo "## $EXPECTED_TITLE" > issue.md
+          echo "" >> issue.md
+          echo "\`\`\`" >> issue.md
+          cat trivy-report-${{ steps.image-name.outputs.image-name }}.txt >> issue.md
+          echo "\`\`\`" >> issue.md
+          echo "" >> issue.md
+          echo -e "\nDetails: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" >> issue.md
+          echo "issue-body-file=issue.md" >> "$GITHUB_OUTPUT"
+
+      - name: Report failures via Github issue
+        run: |
+          export GH_TOKEN=${{ secrets.GH_TOKEN }}
+          EXPECTED_TITLE=$(echo "${{ inputs.issue-title }} ${{ inputs.image-name }}")
+          if [ -z ${{ steps.get-issue-number.outputs.issue-number }} ]; then
+            echo "---- Creating issue ----"
+            gh issue create --repo $GITHUB_REPOSITORY \
+            --title "$EXPECTED_TITLE" \
+            --label "${{ inputs.issue-labels }}" \
+            --body-file "${{ steps.issue-body.outputs.issue-body-file }}"
+          else
+            echo "---- Editing issue ${{ steps.get-issue-number.outputs.issue-number }}----"
+            gh issue edit --repo $GITHUB_REPOSITORY ${{ steps.get-issue-number.outputs.issue-number }} \
+            --title "$EXPECTED_TITLE" \
+            --body-file "${{ steps.issue-body.outputs.issue-body-file }}"
+          fi