Update the trivy-action version from main to specific tag to fix supply chain attack

https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
2026-08-29 04:07:40 +00:00 · 2026-03-27 16:09:53 +08:00
parent e6bdff61bd
commit 91922103b4
1 changed files with 1 additions and 1 deletions
@@ -22,7 +22,7 @@ jobs:
        uses: actions/checkout@v6

      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
        with:
          image-ref: 'docker.io/velero/${{ matrix.images }}:${{ matrix.versions }}'
          severity: 'CRITICAL,HIGH,MEDIUM'