From 25e85f89478c0774f16bb764f1df7acf0495da32 Mon Sep 17 00:00:00 2001 From: Dave Henderson Date: Tue, 22 Oct 2024 10:00:47 -0400 Subject: [PATCH] ci: Update trivy action to run on action updates (#95096) Signed-off-by: Dave Henderson --- .github/workflows/trivy-scan.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 1cd7bec885a..d16f1be773f 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -4,11 +4,13 @@ on: # only run on PRs where go.mod/go.sum/etc have been updated paths: - go.* + - .github/workflows/trivy-scan.yml push: branches: - main paths: - go.* + - .github/workflows/trivy-scan.yml jobs: trivy-scan: @@ -33,7 +35,9 @@ jobs: # for the PR check, ignore JS-related issues skip-files: 'yarn.lock,package.json' - name: Run Trivy vulnerability scanner (SARIF) - uses: aquasecurity/trivy-action@0.28.0 + # Note: versions 0.27.0 and 0.28.0 are broken for SARIF output, but it's + # unclear why - worth testing again in the future + uses: aquasecurity/trivy-action@0.26.0 with: scan-type: 'fs' scanners: 'vuln'