From dc9b0e606d8f4479ad2772870a07954d53f23c2c Mon Sep 17 00:00:00 2001 From: Vatsal Gupta <40350810+gvatsal60@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:13:56 +0530 Subject: [PATCH 1/4] Update Trivy scan workflow to use @master --- .github/workflows/trivy-scan.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/workflows/trivy-scan.yaml diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml new file mode 100644 index 0000000..387f78d --- /dev/null +++ b/.github/workflows/trivy-scan.yaml @@ -0,0 +1,10 @@ +name: Trivy Scan +on: + pull_request: + push: + branches: ["master", "main"] +jobs: + trivy-scan: + uses: gvatsal60/.github/.github/workflows/trivy-scan.yaml@master + with: + dockerfile_exists: false From 3493761a75bffd6151a9a079b244e69d4f4b59fc Mon Sep 17 00:00:00 2001 From: Vatsal Gupta <40350810+gvatsal60@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:30:32 +0530 Subject: [PATCH 2/4] Pin Trivy workflow reference to commit SHA for SonarCloud compliance --- .github/workflows/trivy-scan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml index 387f78d..10da523 100644 --- a/.github/workflows/trivy-scan.yaml +++ b/.github/workflows/trivy-scan.yaml @@ -5,6 +5,6 @@ on: branches: ["master", "main"] jobs: trivy-scan: - uses: gvatsal60/.github/.github/workflows/trivy-scan.yaml@master + uses: gvatsal60/.github/.github/workflows/trivy-scan.yaml@c75bcee46ecb94ecf49361b9d8a0911708d30ca9 with: dockerfile_exists: false From 5eaed44edf4c863951f3e9f2ad1e38d0f1179147 Mon Sep 17 00:00:00 2001 From: Vatsal Gupta <40350810+gvatsal60@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:46:58 +0530 Subject: [PATCH 3/4] Fix: use correct central workflow SHA --- .github/workflows/trivy-scan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml index 10da523..5547802 100644 --- a/.github/workflows/trivy-scan.yaml +++ b/.github/workflows/trivy-scan.yaml @@ -5,6 +5,6 @@ on: branches: ["master", "main"] jobs: trivy-scan: - uses: gvatsal60/.github/.github/workflows/trivy-scan.yaml@c75bcee46ecb94ecf49361b9d8a0911708d30ca9 + uses: gvatsal60/.github/.github/workflows/trivy-scan.yaml@c36e485abb6a54a707d295bb3f8bf48ea5b61aa7 with: dockerfile_exists: false From 1b6ee1c9ec37d8e22b93c20d9f98bbccc32567b4 Mon Sep 17 00:00:00 2001 From: Vatsal Gupta <40350810+gvatsal60@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:53:04 +0530 Subject: [PATCH 4/4] Add security-events: write permission --- .github/workflows/trivy-scan.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml index 5547802..896e606 100644 --- a/.github/workflows/trivy-scan.yaml +++ b/.github/workflows/trivy-scan.yaml @@ -3,6 +3,9 @@ on: pull_request: push: branches: ["master", "main"] +permissions: + contents: read + security-events: write jobs: trivy-scan: uses: gvatsal60/.github/.github/workflows/trivy-scan.yaml@c36e485abb6a54a707d295bb3f8bf48ea5b61aa7