trivy fix

.github/workflows/code_scan.yaml

@@ -28,29 +28,37 @@ jobs:
       - name: Freeze dependencies
         run: pip-compile --extra=docs,base,mmlab,anomaly -o requirements.txt pyproject.toml
 
+      - name: Run Trivy Scan (vuln)
+        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
+        with:
+          scan-type: fs
+          scan-ref: requirements.txt
+          scanners: vuln
+          output: trivy-results-vuln.txt
+
       - name: Trivy Scanning (spdx.json)
         uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
         with:
           scan-type: fs
           scan-ref: .
           format: spdx-json
-          output: trivy-results.spdx.json   
+          output: trivy-results-spdx.json   
 
       - name: Run Trivy Scan (dockerfile and secrets)
         uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
         if: always()
         with:
           scan-type: fs
           scan-ref: .
-          scanners: misconfig,secret,vuln
+          scanners: misconfig,secret
           output: trivy-results-misconfig.txt
           skip-setup-trivy: true
 
       - name: Upload Trivy results artifact
         uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: trivy-results
-          path: "${{ github.workspace }}/trivy-results.*"
+          path: "${{ github.workspace }}/trivy-results-*"
           retention-days: 7
         # Use always() to always run this step to publish scan results when there are test failures
         if: ${{ always() }}