3 ms·

I'm pretty sure the trivy action does not do that.

• woodruffw 7mo ago
  FWICT, it pulls the latest version of trivy by default. If that latest tag is a mutable pointer (and it typically is), then it exhibits the problem.
  • NewJazz 7mo ago
    Then why do they hard code the trivy version and create PRs to bump it? https://github.com/aquasecurity/trivy-action/blob/57a97c7e7821a5776cebc9bb87c984fa69cba8f1/action.yaml#L98 https://github.com/aquasecurity/trivy-action/blob/57a97c7e78... https://github.com/aquasecurity/trivy-action/pull/519 https://github.com/aquasecurity/trivy-action/pull/519 Edit: ah, I see you are referring to the setup-trivy action rather than the trivy-action. Yeah, that looks like a bad default, although to be fair it is a setting that they document quite prominently, and direct usage of the setup-trivy action is a bit atypical as-is.