Skip to content

Update trivy.yml #438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ikostan merged 1 commit into from
Mar 1, 2026
Merged

Update trivy.yml #438

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/trivy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,11 @@ jobs:
security-events: write # For uploading SARIF to Security tab
steps:
- name: "Checkout repository"
uses: "actions/checkout@v6.0.1"
uses: "actions/checkout@v6"

@sourcery-ai sourcery-ai Bot Mar 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 suggestion (security): Consider pinning actions/checkout to a specific commit SHA instead of a moving major tag.

Using the floating v6 tag means behavior can change as new releases are published, which can impact both security and reproducibility. Please pin to the specific commit SHA (as you do for Trivy) and optionally add a comment with the matching version, for example:

uses: actions/checkout@<commit-sha> # v6.x.y

Suggested implementation:

      - name: "Checkout repository"
        uses: "actions/checkout@<commit-sha>"  # v6.x.y
        with:
  1. Replace <commit-sha> with the actual commit SHA for the specific actions/checkout release you want to pin (matching the previously intended v6 version).
  2. Optionally update the inline comment # v6.x.y to the precise version (e.g., # v6.1.0) once you've chosen and verified the release.
  3. Ensure that the chosen SHA comes from the official actions/checkout repository and corresponds to a tagged release for better traceability.

with:
fetch-depth: 0 # Fetches all history for all branches and tags
# This explicitly tells the runner to use the branch that triggered the workflow
ref: ${{ github.ref_name }}
fetch-depth: 0
persist-credentials: false
- name: "Run Trivy vulnerability scanner"
uses: "aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284" # Pinned to SHA for v0.34.0
Expand Down
Loading