From 22c2f061edab6a29505df34f8da493f2ea1160f1 Mon Sep 17 00:00:00 2001 From: Meher <156025996+meher-liatrio@users.noreply.github.com> Date: Thu, 16 Apr 2026 13:14:29 -0700 Subject: [PATCH] fix: Update Trivy setup action version to v0.2.6 The third party action was pinned to a compromised version, the release of which has been removed and is causing the audit pipeline to fail: https://github.com/pact-foundation/pact-broker-docker/actions/runs/24487795586 This pr pins the action to the commit sha of the only currently valid release per the docs: https://github.com/aquasecurity/setup-trivy Further rumination steps may be required by maintainers: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ --- .github/workflows/audit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 973995c..561d253 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -21,7 +21,7 @@ jobs: steps: - uses: actions/checkout@v5 - name: Manual Trivy Setup - uses: aquasecurity/setup-trivy@v0.2.4 + uses: aquasecurity/setup-trivy@ve07451d2e059ed86c2870430ea286b3a9e0bf241 #v0.2.6 with: cache: true - name: Audit Docker image for amd64