feat: add nightly copa scan and patch workflow

.pipelines/templates/patch-images.yaml

@@ -0,0 +1,61 @@
+pr: none
+
+schedules:
+  - cron: "0 0 * * *" # nightly
+    always: true
+    displayName: "Copa Patch"
+    branches:
+      include:
+        - main
+
+pool: staging-pool-amd64-mariner-2
+
+jobs:    
+  - job: patch
+      strategy:
+        fail-fast: false
+        matrix:
+          images: ['ghcr.io/azure/azure-workload-identity/proxy-init:latest-linux-arm64', 'ghcr.io/azure/azure-workload-identity/proxy-init:latest-linux-amd64']
+      steps:
+      - name: Generate Trivy Report
+        uses: aquasecurity/trivy-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
+        with:
+          scan-type: 'image'
+          format: 'json'
+          output: 'report.json'
+          ignore-unfixed: true
+          vuln-type: 'os'
+          image-ref:  ${{ matrix.images }}
+      - name: Check Vuln Count
+        id: vuln_cout
+        run: |
+          report_file="report.json"
+          vuln_count=$(jq '.Results | length' "$report_file")
+          echo "vuln_count=$vuln_count" >> $GITHUB_OUTPUT
+      - name: Copa Action
+        if: steps.vuln_cout.outputs.vuln_count != '0'
+        id: copa
+        uses: project-copacetic/[email protected]
+        with:
+          image:  ${{ matrix.images }}
+          image-report: 'report.json'
+          patched-tag: 'patched'
+          buildkit-version: 'v0.12.1'
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@ecf95283f03858871ff00b787d79c419715afc34
+      - name: Login to ghcr.io
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Push patched image
+        run: |
+          docker tag ghcr.io/azure/azure-workload-identity/proxy-init:patched ${{ matrix.images }}
+          docker push ${{ matrix.images }}
+  - job: create and push updated manifest
+      steps:
+      - name: docker manifest create
+        run: |
+          docker manifest create ghcr.io/azure/azure-workload-identity/proxy-init:latest ghcr.io/azure/azure-workload-identity/proxy-init:latest-linux-arm64 ghcr.io/azure/azure-workload-identity/proxy-init:latest-linux-amd64
+          docker manifest push ghcr.io/azure/azure-workload-identity/proxy-init:latest