Advanced AI Prompt for Container Registry Immutability and Tagging

Act as a Container Security Specialist. Create a rigid GitHub Actions workflow that forcefully enforces Docker image immutability and continuous security profiling. Implement a complex [TAGGING_STRATEGY] that simultaneously tags the image with the exact short Git SHA, the pipeline Run ID, and the semantic version extracted from `package.json`. Immediately following the build step, and strictly *before* pushing to the [REGISTRY_URL], the runner must execute a blocking scan utilizing the [VULNERABILITY_SCANNER] CLI (e.g., Trivy or Snyk). Program the YAML logic to parse the scanner's JSON output: if any CVEs matching 'High' or 'Critical' severity levels are detected, the pipeline must instantly terminate (`exit 1`), physically blocking the compromised image from entering the production registry.