fix: login to container registry before scan to support private repos

action.yaml

@@ -36,6 +36,20 @@ branding:
 runs:
   using: composite
   steps:
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ github.actor }}
+        password: ${{ inputs.token }}
+
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ github.actor }}
+        password: ${{ inputs.token }}
+
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/[email protected]
       with:
@@ -63,13 +77,6 @@ runs:
       if: ${{ inputs.attest }}
       uses: sigstore/[email protected]
 
-    - name: Login to GitHub Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ inputs.registry }}
-        username: ${{ github.actor }}
-        password: ${{ inputs.token }}
-
     - name: Convert trivy results to cosign-vuln
       if: ${{ inputs.attest && !inputs.digest }}
       uses: aquasecurity/[email protected]