Make Trivy scan advisory instead of blocking

Audio containers inherit from upstream third-party bases (Speaches,
Kokoro, NVIDIA CUDA). Residual CVEs in distro packages without
backported fixes flow through even after apt-get upgrade. Blocking
release on those creates an impossible cleanup cycle for issues
outside our codebase.

Add continue-on-error: true to the Trivy step. The scan still runs,
the report still appears as workflow annotations, and reviewers can
see exactly what's flagged. Only image build + push remains as the
hard gate.

Same pattern used upstream by whisper.cpp, kokoro, and other
container projects that ship on top of third-party bases.

Author: michael-chipmates

.github/workflows/docker-publish.yml

@@ -113,7 +113,15 @@ jobs:
         continue-on-error: true
 
       - name: Scan with Trivy
+        # Advisory only. Audio containers track upstream third-party bases
+        # (Speaches, Kokoro, NVIDIA CUDA). We patch what apt/apk can fix
+        # via base-image upgrades in each Dockerfile, but residual CVEs in
+        # distro packages without backported fixes (Debian trixie, Ubuntu
+        # 22.04) flow through. Reporting CVEs as workflow annotations is
+        # the visibility we want; gating the release on them blocks
+        # publishing for issues we can't fix without changing upstream.
         uses: aquasecurity/trivy-action@master
+        continue-on-error: true
         with:
           image-ref: ghcr.io/chipmates/${{ matrix.image.name }}@${{ steps.build.outputs.digest }}
           format: table