DevSecOps with Trivy and GitHub Actions

**Executive summary:** This post describes how to integrate security into a Go microservice CI pipeline by using GitHub Actions to build containers, Trivy to scan images for vulnerabilities, and GoReleaser to produce and publish release artifacts; it details build vs. release workflows, configuration notes, and how to fail builds on detected vulnerabilities to enable early remediation.