mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 11:12:35 +02:00
maziggy
c839841063
The scan pinned Trivy v0.69.1, which aquasecurity have since deleted -- retained releases now run v0.74.0 down to v0.69.2 and then jump back to v0.26.0. The tag survives, so setup-trivy resolves it, reports "found version: 0.69.1" and then exits 1 with no asset to fetch. This repository did not notice because the binary was coming back from the Actions cache on every run, which skips the download. Forks have no such cache, which is where it was reported from -- and the same failure was due here the first time that entry went cold. Both scans move to trivy-action v0.36.0 and Trivy v0.74.0; every input they pass is still declared in the new action. The comment records that this pin has to be bumped rather than left, and that a green run is not evidence it still resolves. The config scan is clean on v0.74.0, so the bump adds no new misconfiguration alerts.