Hacker News new | ask | show | jobs
by NewJazz 82 days ago
I'm pretty sure the trivy action does not do that.
1 comments
woodruffw 82 days ago
FWICT, it pulls the latest version of trivy by default. If that latest tag is a mutable pointer (and it typically is), then it exhibits the problem.
link
NewJazz 82 days ago
Then why do they hard code the trivy version and create PRs to bump it?

https://github.com/aquasecurity/trivy-action/blob/57a97c7e78...

https://github.com/aquasecurity/trivy-action/pull/519

Edit: ah, I see you are referring to the setup-trivy action rather than the trivy-action. Yeah, that looks like a bad default, although to be fair it is a setting that they document quite prominently, and direct usage of the setup-trivy action is a bit atypical as-is.

link