Skip to content
This repository was archived by the owner on May 3, 2026. It is now read-only.

chore(ci): fix Trivy scanner param and runner #572

Closed
DerekRoberts wants to merge 1 commit into from
Closed

chore(ci): fix Trivy scanner param and runner #572

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
trivy:
name: Trivy Security Scan
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-24.04
runs-on: ubuntu-latest
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using ubuntu-latest makes the workflow non-deterministic because the underlying Ubuntu version changes over time and may already resolve to 24.04, which would not address the reported Trivy download issue. If the goal is to avoid 24.04, consider pinning to a known-good runner image (e.g., ubuntu-22.04) and keep runner versions consistent with other workflows in this repo that are explicitly pinned (e.g., .github/workflows/merge.yml, .github/workflows/.tests.yml).

Suggested change
runs-on: ubuntu-latest
runs-on: ubuntu-22.04

Copilot uses AI. Check for mistakes.
permissions:
contents: read
security-events: write
Expand All @@ -35,7 +35,7 @@ jobs:
output: "trivy-results.sarif"
ignore-unfixed: true
scan-type: "fs"
scanners: "vuln,secret,config"
scanners: "vuln,secret,misconfig"
severity: "CRITICAL,HIGH"

- name: Upload Trivy scan results to GitHub Security tab
Expand Down
Loading