diff --git a/.github/workflows/create-docker-image-job.yml b/.github/workflows/create-docker-image-job.yml index 44d68a089..dc142c354 100644 --- a/.github/workflows/create-docker-image-job.yml +++ b/.github/workflows/create-docker-image-job.yml @@ -26,7 +26,7 @@ jobs: - name: Build docker image run: docker build --tag ${{ inputs.container-registry }}/${{ inputs.container-image-name }}:${{ inputs.container-image-version }} -f DockerfileApp . - name: Run Trivy vulnerability image scanner - uses: aquasecurity/trivy-action@a20de5420d57c4102486cdd9578b45609c99d7eb + uses: aquasecurity/trivy-action@807896715e16054f9ae275ea68a15ee3908f0124 env: ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db @@ -57,7 +57,7 @@ jobs: sarif_file: "trivy-results.sarif" category: trivy-image-scan - name: Generate cosign vulnerability scan record - uses: aquasecurity/trivy-action@a20de5420d57c4102486cdd9578b45609c99d7eb + uses: aquasecurity/trivy-action@807896715e16054f9ae275ea68a15ee3908f0124 env: ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db diff --git a/.github/workflows/early-daily-trivy.yml b/.github/workflows/early-daily-trivy.yml index 823091d26..2d4b26d59 100644 --- a/.github/workflows/early-daily-trivy.yml +++ b/.github/workflows/early-daily-trivy.yml @@ -25,7 +25,7 @@ jobs: - name: Run Trivy vulnerability file scanner # Third-party action, pin to commit SHA! # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions - uses: aquasecurity/trivy-action@a20de5420d57c4102486cdd9578b45609c99d7eb + uses: aquasecurity/trivy-action@807896715e16054f9ae275ea68a15ee3908f0124 env: ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db @@ -69,7 +69,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: Run Trivy vulnerability image scanner - uses: aquasecurity/trivy-action@a20de5420d57c4102486cdd9578b45609c99d7eb + uses: aquasecurity/trivy-action@807896715e16054f9ae275ea68a15ee3908f0124 env: ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db @@ -94,7 +94,7 @@ jobs: sarif_file: "trivy-results.sarif" category: trivy-image-scan - name: Generate cosign vulnerability scan record - uses: aquasecurity/trivy-action@a20de5420d57c4102486cdd9578b45609c99d7eb + uses: aquasecurity/trivy-action@807896715e16054f9ae275ea68a15ee3908f0124 env: ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} TRIVY_USERNAME: ${{ github.actor }} diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index a3c821ad3..a8be5cd0d 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -125,7 +125,7 @@ jobs: - name: Checkout code uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@a20de5420d57c4102486cdd9578b45609c99d7eb + uses: aquasecurity/trivy-action@807896715e16054f9ae275ea68a15ee3908f0124 env: ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db