From fe114765efe803c035766b71bd7a34044272264c Mon Sep 17 00:00:00 2001
From: Jean-Philippe Evrard <open-source@a.spamming.party>
Date: Thu, 19 Mar 2026 18:53:25 +0100
Subject: [PATCH] Manually bump trivy

Without this, the CI will fail to use trivy.

Multiple reasons:
- We used shas + tags in the past. This was to guarantee the
version matches the release. Sadly that behaviour has changed
since september 2025, and dependabot does not update anymore
the sha pinned actions unless the version is also in comment.
This will be fixed in another PR.
- Trivy releases had to be republished since trivy security
incident.
- Old releases should not be used, so bumping is necessary.

Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
---
 .github/workflows/on-pr.yaml            | 2 +-
 .github/workflows/on-tag.yaml           | 2 +-
 .github/workflows/periodics-weekly.yaml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml
index e8fd740..12c7df3 100644
--- a/.github/workflows/on-pr.yaml
+++ b/.github/workflows/on-pr.yaml
@@ -73,7 +73,7 @@ jobs:
         run: VERSION="${{ steps.tags.outputs.sha_short }}" DH_ORG="${{ github.repository_owner }}" make image
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
           image-ref: 'ghcr.io/${{ github.repository }}:${{ steps.tags.outputs.sha_short }}'
           format: 'table'
diff --git a/.github/workflows/on-tag.yaml b/.github/workflows/on-tag.yaml
index 0efaaa5..169935f 100644
--- a/.github/workflows/on-tag.yaml
+++ b/.github/workflows/on-tag.yaml
@@ -66,7 +66,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.version }}
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
           image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.version }}'
           format: 'table'
diff --git a/.github/workflows/periodics-weekly.yaml b/.github/workflows/periodics-weekly.yaml
index ab5a068..aa82b8f 100644
--- a/.github/workflows/periodics-weekly.yaml
+++ b/.github/workflows/periodics-weekly.yaml
@@ -106,7 +106,7 @@ jobs:
       - name: Build artifacts
         run: VERSION="${{ steps.tags.outputs.sha_short }}" DH_ORG="${{ github.repository_owner }}" make image
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
           image-ref: 'ghcr.io/${{ github.repository }}:${{ steps.tags.outputs.sha_short }}'
           format: 'table'