Curling latest Trivy version seems to fail and thus fail a Travis CI build

[NathanPabon]

Hi everyone,

I'm currently running into in an issue where a script in our Travis CI workflow that retrieves and runs the latest version of Trivy is failing when the build occurs.

This is the script we're using to start a Trivy scan in our CI workflow.
It is based off of the script in the following page: https://aquasecurity.github.io/trivy/v0.20.1/advanced/integrations/travis-ci/.

export VERSION=$(curl --silent "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz
tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz

./trivy --exit-code 0 --severity HIGH --no-progress ${REPO_NAME}
./trivy --exit-code 1 --severity CRITICAL --no-progress ${REPO_NAME}

The REPO_NAME variable is just the name of the Docker image.

The resulting output in our build log is the following.

--2021-10-21 15:48:28--  https://github.com/aquasecurity/trivy/releases/download/v/trivy__Linux-64bit.tar.gz
Resolving github.com (github.com)... 140.82.113.3
Connecting to github.com (github.com)|140.82.113.3|:443... connected.
HTTP request sent, awaiting response... 404 Not Found
2021-10-21 15:48:28 ERROR 404: Not Found.

My assumption is that CURLing the latest Trivy version is somehow failing and results in the environment variable VERSION being set to an empty string.

As consequence, the wget line is being provided with no version number which leads it to 404 and thus fail the build.

Strangely enough, if you wait a few minutes and try again it seems to resolve itself.

I was wondering if anyone else here may be running into this issue themselves and what I can do to remediate this.

Thanks!