Feature: Dockerfile.server security scanning
  As a DevOps engineer
  I want the CI pipeline to scan the Dockerfile.server image for vulnerabilities
  So that we can prevent insecure images from being deployed to production

  Background:
    Given the Dockerfile.server exists in the repository root
    And Trivy is available in the CI environment

  Scenario: Security scan step is configured in CI pipeline
    Given the CI workflow file exists at .forgejo/workflows/ci.yml
    When I examine the docker job in the CI workflow
    Then the docker job should include a step to scan the Dockerfile.server image
    And the scan step should use Trivy or equivalent tool
    And the scan step should be configured to fail on HIGH or CRITICAL severity findings

  Scenario: Scan results are visible in CI output
    Given a Dockerfile.server image has been built
    When the security scan is executed
    Then the scan results should be displayed in the CI job output
    And the output should include a summary of vulnerabilities found
    And the output should indicate the severity levels of findings

  Scenario: Pipeline fails on high-severity vulnerabilities
    Given a Dockerfile.server image with known HIGH severity vulnerabilities
    When the security scan is executed
    Then the scan should exit with a non-zero status code
    And the CI job should fail
    And the failure should block merge to master

  Scenario: Pipeline passes when no high-severity vulnerabilities exist
    Given a Dockerfile.server image with no HIGH or CRITICAL severity vulnerabilities
    When the security scan is executed
    Then the scan should exit with status code 0
    And the CI job should pass
    And the build can proceed to the next stage