Merge branch 'main' of github.com:DmitriyLewen/trivy into fix/release-please-multiline-commit

Author: DmitriyLewen

.github/CODEOWNERS

@@ -1,5 +1,5 @@
 # Global
-*   @knqyf263
+*   @knqyf263 @DmitriyLewen
 
 # SBOM/Vulnerability scanning
 pkg/dependency/  @knqyf263 @DmitriyLewen
@@ -8,15 +8,15 @@ pkg/sbom/        @knqyf263 @DmitriyLewen
 pkg/scanner/     @knqyf263 @DmitriyLewen
 
 # Misconfiguration scanning
-docs/guide/scanner/misconfiguration/  @simar7 @nikpivkin
-docs/guide/target/aws.md              @simar7 @nikpivkin
-pkg/fanal/analyzer/config/            @simar7 @nikpivkin
-pkg/config/aws/                       @simar7 @nikpivkin
-pkg/iac/                              @simar7 @nikpivkin
+docs/guide/scanner/misconfiguration/  @nikpivkin
+docs/guide/target/aws.md              @nikpivkin
+pkg/fanal/analyzer/config/            @nikpivkin
+pkg/config/aws/                       @nikpivkin
+pkg/iac/                              @nikpivkin
 
 # Helm chart
-helm/trivy/ @afdesk @simar7
+helm/trivy/ @afdesk
 
 # Kubernetes scanning
-pkg/k8s/                         @afdesk @simar7
-docs/guide/target/kubernetes.md   @afdesk @simar7
+pkg/k8s/                         @afdesk
+docs/guide/target/kubernetes.md   @afdesk

.github/actions/setup-go/action.yaml

@@ -26,7 +26,7 @@ runs:
         echo "version=$major_minor" >> "$GITHUB_OUTPUT"
 
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: ${{ steps.go-version.outputs.version }}
         cache: false

.github/actions/trivy-triage/action.yaml

@@ -8,7 +8,7 @@ runs:
   using: "composite"
   steps:
     - name: Conditionally label discussions based on category and content
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         GH_TOKEN: ${{ github.token }}
         DISCUSSION_NUM: ${{ inputs.discussion_num }}

.github/workflows/auto-close-issue.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-2404-2core
     steps:
       - name: Close issue if user does not have write or admin permissions
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // Get the issue creator's username

.github/workflows/auto-ready-for-review.yaml

@@ -34,7 +34,7 @@ jobs:
           
       - name: Check PR and all workflows status
         if: steps.pr-context.outputs.skip != 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr-context.outputs.number }}
         with:

.github/workflows/backport.yaml

@@ -34,11 +34,23 @@ jobs:
       startsWith(github.event.comment.body, '@aqua-bot backport release/')
     runs-on: ubuntu-2404-2core
     steps:
+      # GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the backport
+      # PR would not run CI — generate a GitHub App installation token instead.
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: true # backport.sh runs git push
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Extract branch name
         env:
@@ -58,8 +70,6 @@ jobs:
 
       - name: Run backport script
         env:
-          # Use TRIVY_REPO_TOKEN instead of GITHUB_TOKEN
-          # This allows the created PR to trigger tests and other workflows
-          GITHUB_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: ./misc/backport/backport.sh "$BRANCH_NAME" "$ISSUE_NUMBER"

.github/workflows/cache-test-assets.yaml

@@ -34,7 +34,7 @@ jobs:
           echo "digest=$DIGEST" >> $GITHUB_OUTPUT
 
       - name: Restore and save test images cache
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: integration/testdata/fixtures/images
           key: cache-test-images-${{ steps.image-digest.outputs.digest }}
@@ -66,7 +66,7 @@ jobs:
           echo "digest=$DIGEST" >> $GITHUB_OUTPUT
 
       - name: Restore and save test VM images cache
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: integration/testdata/fixtures/vm-images
           key: cache-test-vm-images-${{ steps.image-digest.outputs.digest }}
@@ -89,7 +89,7 @@ jobs:
       - name: Run golangci-lint for caching
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
-          version: v2.10
+          version: v2.12
           args: --verbose
         env:
           GOEXPERIMENT: jsonv2

.github/workflows/canary.yaml

@@ -23,7 +23,6 @@ jobs:
       ECR_ACCESS_KEY_ID: ${{ secrets.ECR_ACCESS_KEY_ID }}
       ECR_SECRET_ACCESS_KEY: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
       GPG_KEY: ${{ secrets.GPG_KEY }}
-      TRIVY_REPO_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
   upload-binaries:
@@ -34,35 +33,35 @@ jobs:
       actions: write # Required to delete caches
     steps:
       - name: Restore Trivy binaries from cache
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: dist/
           key: ${{ runner.os }}-bins-${{ github.workflow }}-${{ github.sha }}
 
         # Upload artifacts
       - name: Upload artifacts (trivy_Linux-64bit)
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy_Linux-64bit
           path: dist/trivy_*_Linux-64bit.tar.gz
           if-no-files-found: error
 
       - name: Upload artifacts (trivy_Linux-ARM64)
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy_Linux-ARM64
           path: dist/trivy_*_Linux-ARM64.tar.gz
           if-no-files-found: error
 
       - name: Upload artifacts (trivy_macOS-64bit)
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy_macOS-64bit
           path: dist/trivy_*_macOS-64bit.tar.gz
           if-no-files-found: error
 
       - name: Upload artifacts (trivy_macOS-ARM64)
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy_macOS-ARM64
           path: dist/trivy_*_macOS-ARM64.tar.gz

.github/workflows/mkdocs-latest.yaml

@@ -41,15 +41,24 @@ jobs:
         run: mike deploy --push --update-aliases "$DOCS_VERSION" latest
 
   # This workflow is used to trigger the trivy-www deployment
-  trigger-trivy-www-deploy: 
+  trigger-trivy-www-deploy:
     needs: deploy
     runs-on: ubuntu-2404-2core
     steps:
-      - name: Trigger update_version workflow in trivy-telemetry
+      # GITHUB_TOKEN is scoped to the current repository and cannot trigger
+      # workflows in other repos — generate a GitHub App installation token instead.
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ secrets.ACTIONS_MULTI_WRITE_GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: trivy-www
+          permission-actions: write
+      - name: Trigger build-docs workflow in trivy-www
         env:
-          # Use TRIVY_WORKFLOW_TRIGGER_TOKEN instead of GITHUB_TOKEN
-          # This allows triggering workflows in other repositories
-          GH_TOKEN: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           gh workflow run build-docs.yml \
             --repo "$GITHUB_REPOSITORY_OWNER/trivy-www" \

.github/workflows/publish-chart.yaml

@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           version: v3.14.4
       - name: Set up python
@@ -61,9 +61,20 @@ jobs:
       - test-chart
     runs-on: ubuntu-2404-2core
     steps:
+      # GITHUB_TOKEN is scoped to the current repository and cannot trigger
+      # workflows in other repos — generate a GitHub App installation token instead.
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ secrets.ACTIONS_MULTI_WRITE_GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: helm-charts
+          permission-actions: write
       - name: Trigger publish-chart workflow in helm-charts
         env:
-          GH_TOKEN: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REF: ${{ github.sha }}
         run: |
           gh workflow run publish-chart.yaml \