From f4920c5781dd4c3780fbaa3779f996c7d4eae4e8 Mon Sep 17 00:00:00 2001 From: mbiuki Date: Wed, 29 Jul 2026 13:08:25 -0400 Subject: [PATCH 1/2] fix(ci): pin trivy-action to existing tag v0.33.1 in image CVE scan The Scheduled Image CVE Scan referenced `aquasecurity/trivy-action@0.33.1`, but the action's tags are v-prefixed (`v0.33.1`). GitHub could not resolve the version, so the job failed at "Set up job" before running any scan. Add the missing `v` prefix to both uses of the action. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/cicd_scheduled_image-cve-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cicd_scheduled_image-cve-scan.yml b/.github/workflows/cicd_scheduled_image-cve-scan.yml index 60879c44dc17..d8fa077cad81 100644 --- a/.github/workflows/cicd_scheduled_image-cve-scan.yml +++ b/.github/workflows/cicd_scheduled_image-cve-scan.yml @@ -32,7 +32,7 @@ jobs: IMAGE: ${{ inputs.image || 'dotcms/dotcms:latest' }} steps: - name: Run Trivy (SARIF for Security tab) - uses: aquasecurity/trivy-action@0.33.1 + uses: aquasecurity/trivy-action@v0.33.1 with: image-ref: ${{ env.IMAGE }} format: sarif @@ -48,7 +48,7 @@ jobs: category: image-cve-scan - name: Run Trivy (table summary) - uses: aquasecurity/trivy-action@0.33.1 + uses: aquasecurity/trivy-action@v0.33.1 with: image-ref: ${{ env.IMAGE }} format: table From 7ed31fe17b64dfecbb9ef3b0beea3e2db7c1ad97 Mon Sep 17 00:00:00 2001 From: mbiuki Date: Wed, 29 Jul 2026 13:20:19 -0400 Subject: [PATCH 2/2] fix(ci): bump trivy-action to v0.36.0 so it installs a real trivy release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pinning the v prefix fixed action resolution, but v0.33.1 hardcodes trivy binary v0.65.0, which has no GitHub release — the installer found the tag then failed (exit 1) trying to download a nonexistent asset. v0.36.0 defaults to trivy v0.70.0 (a valid release) and hash-pins its setup-trivy installer, fixing the binary install and keeping the scanner on a current version. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/cicd_scheduled_image-cve-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cicd_scheduled_image-cve-scan.yml b/.github/workflows/cicd_scheduled_image-cve-scan.yml index d8fa077cad81..65ec6cc5a9fd 100644 --- a/.github/workflows/cicd_scheduled_image-cve-scan.yml +++ b/.github/workflows/cicd_scheduled_image-cve-scan.yml @@ -32,7 +32,7 @@ jobs: IMAGE: ${{ inputs.image || 'dotcms/dotcms:latest' }} steps: - name: Run Trivy (SARIF for Security tab) - uses: aquasecurity/trivy-action@v0.33.1 + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: ${{ env.IMAGE }} format: sarif @@ -48,7 +48,7 @@ jobs: category: image-cve-scan - name: Run Trivy (table summary) - uses: aquasecurity/trivy-action@v0.33.1 + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: ${{ env.IMAGE }} format: table