Fix pipeline scan job

[JunAr7112]

Description

This PR is created in response to the following breaking pipeline changes:

1. Pulse Scanners — Removal of --ssa $SSA_TOKEN Flag: Remove --ssa $SSA_TOKEN from any direct CLI invocations. The token is fetched from the environment variable SSA_TOKEN.

This change will use the cli invocation to fix this:
pulse-cli -n "${NSPECT_ID}" scan-image -i "${CONTAINER_IMAGE}" --platform "${PLATFORM}" -p "${CONTAINER_POLICY}" --output-dir="scan-results" -o

2. Pulse Container Scanner — Docker / DIND capabilities removed: Migrate to registry based scanning which is daemonless. If your job requires Docker CLI commands independent of scanning, add those explicitly to your job definition. Docker login has been replaced with a config.json-based approach. The scanner container now runs as a non-root user. Config is written to $HOME/.docker/config.json (was hardcoded /root/.docker/). File permissions are locked down (chmod 700 ~/.docker, chmod 600 config.json). REGISTRY_AUTH_FILE is exported for skopeo compatibility

This change will replace docker login + docker pull + docker save with registry-based scanning via a $HOME/.docker/config.json and an exported REGISTRY_AUTH_FILE, and disables the inherited docker:dind sidecar with services: []

Checklist

• [ x] No secrets, sensitive information, or unrelated changes
• Lint checks passing (make lint)
• Generated assets in-sync (make validate-generated-assets)
• Go mod artifacts in-sync (make validate-modules)
• Test cases are added for new code paths

Testing

Tested on Gitlab. Verified pipeline scan job is running now.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coveralls]

Coverage Report for CI Build 35005520761

Coverage remained the same at 44.09%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	13681
Covered Lines:	6032
Line Coverage:	44.09%
Coverage Strength:	0.44 hits per line

---

💛 - Coveralls