try not to fail because vulnix finds vulnerabilities

ci-tools/vulnerability-scan

@@ -30,4 +30,6 @@ else
 fi
 '
 
-nix-shell -p vulnix --run 'vulnix ./scan-target/' | tee "$OUTPUT"
+# vulnix exits with an error status if there are vulnerabilities.  we don't
+# want to fail the job in that case because then we can't see the report.
+nix-shell -p vulnix --run 'vulnix ./scan-target/ || true' | tee "$OUTPUT"