ci: fix zizmor github-app and unpinned-tools issues (#570)

* ci: fix zizmor github-app and unpinned-tools issues

* chore: update comment

Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>

---------

Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>

.github/workflows/bump-trivy.yaml

@@ -51,6 +51,8 @@ jobs:
           private-key: ${{ secrets.REPO_TRIVY_ACTION_WRITE_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create PR
         env:

action.yaml

@@ -128,7 +128,8 @@ runs:
       # be used.
       uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.6
       with:
-        version: ${{ inputs.version }}
+        # version is pinned by default; using a floating tag like `latest` is the caller's responsibility
+        version: ${{ inputs.version }} # zizmor: ignore[unpinned-tools]
         cache: ${{ inputs.cache }}
         token: ${{ inputs.token-setup-trivy }}