How would you enforce security scanning as part of a CI/CD pipeline?

Add a scanning step immediately after the docker build step (before push to registry), running a tool like Trivy with a severity threshold and a non-zero exit code on matching findings (--severity CRITICAL,HIGH --exit-code 1), which fails the pipeline automatically. This should run on every commit/PR, not as a manual or periodic check, so vulnerabilities are caught before merge, not after deployment.