Pinning Trivy GH Action to commit hash for v0.35.0

[lreading]

Summary:

Relates to #1518

Updates all Trivy GH Actions to v0.35.0 - but using the commit hash instead of a version tag.

Our Trivy actions are failing because the tags they reference are no longer available. All tags were removed as part of the containment effort by AcquaSecurity (the makers of Trivy) related to a recent compromise.

Unlike tags, commit hashes are immutable. Even if the git history is rewritten, the commit becomes orphaned rather than overwritten.

Description for the changelog:

Pin Trivy GitHub action to specific commit

Declaration:

Thanks for submitting a pull request, please make sure:

• content meets the license for this project
• appropriate unit tests have been created and/or modified
• you have considered any changes required for the functional tests
• you have read the contribution guide and agree to the Code of Conduct
• either no AI-generated content has been used in this pull request
• or any use of AI in this pull request has been disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie, etc]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro, etc]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Other info:

This is the exact recommendation from AquaSecurity: https://www.aquasec.com/blog/autonomous-runtime-security-turning-runtime-intelligence-into-agentic-response-2/

I think there needs to be a larger discussion around GH Actions / dependency pinning. Aggressive pinning like this does increase maintenance overhead, and it is also less readable than a tag which is usually a semantic version. However, due to the immutable nature of commit hashes, this is significantly more secure from a dependency management / supply chain hardening perspective.

[lreading]

To check for successful credential rotation, I manually ran the CI pipeline: https://github.com/OWASP/threat-dragon/actions/runs/23407258044

• the desktop e2e tests failed (expected, see Fix Desktop e2e Menu Test to Use Latest Release #1516 )
• Heroku deploy passed (successful rotation)
• Browserstack automation worked (successful rotation)

No other keys were rotated, so I think we are good.

[jgadsden]

that seemed to do it, thanks @lreading for the investigation