Add private GHCR access for Agent scans

[Gabrielvcg]

Summary

• mount a dedicated read-only Docker configuration into the production Agent
• install the credential from a protected GHCR_AGENT_READ_TOKEN environment secret without sharing the host Docker login or socket
• validate the mount in CI and document rotation and private-image operation

Verification

• �ash -n deploy/deploy.sh
• production Compose renders with DOCKER_CONFIG=/run/vulnflow-registry, a read-only credential mount, and no Docker socket
• workflow YAML parses successfully
• git diff --check

Deployment prerequisite

Create the protected production secret GHCR_AGENT_READ_TOKEN from a dedicated classic PAT carrying only
ead:packages. The deploy job intentionally refuses to proceed when it is absent.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud