From 52d14fa83d02c989cf4a8cf85ee0dbf089ac145e Mon Sep 17 00:00:00 2001 From: Nikita Pivkin Date: Mon, 15 Jun 2026 16:31:36 +0600 Subject: [PATCH] ci: fix zizmor github-app and unpinned-tools issues (#570) * ci: fix zizmor github-app and unpinned-tools issues * chore: update comment Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com> --------- Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com> --- .github/workflows/bump-trivy.yaml | 2 ++ action.yaml | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bump-trivy.yaml b/.github/workflows/bump-trivy.yaml index a274573..29a0a3a 100644 --- a/.github/workflows/bump-trivy.yaml +++ b/.github/workflows/bump-trivy.yaml @@ -51,6 +51,8 @@ jobs: private-key: ${{ secrets.REPO_TRIVY_ACTION_WRITE_GH_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: ${{ github.event.repository.name }} + permission-contents: write + permission-pull-requests: write - name: Create PR env: diff --git a/action.yaml b/action.yaml index 706900f..ed52dfb 100644 --- a/action.yaml +++ b/action.yaml @@ -128,7 +128,8 @@ runs: # be used. uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.6 with: - version: ${{ inputs.version }} + # version is pinned by default; using a floating tag like `latest` is the caller's responsibility + version: ${{ inputs.version }} # zizmor: ignore[unpinned-tools] cache: ${{ inputs.cache }} token: ${{ inputs.token-setup-trivy }}