Container scanning

.gitlab-ci.yml

 include: 
   - local: tests/unit.gitlab-ci.yml
   - local: tests/integration.gitlab-ci.yml
+  - component: gitlab.com/components/container-scanning/container-scanning@1.0
+    inputs:
+      stage: quality
+      # FIXME: why do I have to set this, this is weird ...
+      force_run: true
 
 stages:
   - build
   - test
   - test-integration
+  - quality
   - deploy
   - release
   - cleanup
@@ -54,6 +60,12 @@ gitlab-opentofu-image:build:
       --push
       .
 
+container_scanning:
+  extends: .opentofu-versions
+  needs: ['gitlab-opentofu-image:build']
+  variables:
+    CS_IMAGE: $GITLAB_OPENTOFU_IMAGE_NAME
+
 gitlab-opentofu-image:deploy:
   extends: .opentofu-versions
   stage: deploy