diff --git a/.gitea/workflows/test-pr.yml b/.gitea/workflows/test-pr.yml
index 149102b..3cfb875 100644
--- a/.gitea/workflows/test-pr.yml
+++ b/.gitea/workflows/test-pr.yml
@@ -23,4 +23,19 @@ jobs:
         uses: golang/govulncheck-action@v1
         with:
           go-version-file: 'go.mod'
-          go-package: ./...
\ No newline at end of file
+          go-package: ./...
+
+  code-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Trivy vulnerability scanner in repo mode
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: '1'
+          severity: 'CRITICAL,HIGH'