only run trivy scan on image bumps

Author: bertiethorpe

.github/workflows/trivyscan.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - ci/nightly-builds
+    paths:
+      - 'environments/.stackhpc/terraform/cluster_image.json'
 
 jobs:
   scan:

environments/.stackhpc/terraform/main.tf

@@ -25,10 +25,14 @@ variable "os_version" {
   default = "RL9"
 }
 
+locals {
+  image_names = jsondecode(file("./cluster_image.json"))
+}
+
 variable "cluster_image" {
     description = "single image for all cluster nodes, keyed by os_version - a convenience for CI"
     type = map(string)
-    default = jsondecode(file("./cluster_image.json"))
+    default = locals.image_names
 }
 
 variable "cluster_net" {}