trivy

Bump aquasecurity/trivy-action from 0.34.0 to 0.35.0 (#860) #3279

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	name: trivy
	permissions: {}

	on:
	workflow_dispatch:
	inputs:
	run:
	description: "Run the workflow"
	required: true
	default: true
	type: boolean
	push:
	branches:
	- main
	pull_request:
	schedule:
	# every Monday at 7:31pm
	- cron: "31 19 * * 1"

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	scan:
	name: Build
	runs-on: "ubuntu-latest"
	permissions:
	security-events: write # Needed to upload the analysis results

	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Trivy Vulnerability Scan
	uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
	with:
	scan-type: "fs"
	severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
	scan-ref: "."
	scanners: "vuln"
	format: "sarif"
	output: "trivy-results.sarif"
	exit-code: 1

	- name: Trivy License Scan
	uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
	with:
	scan-type: "fs"
	severity: "HIGH,CRITICAL"
	scan-ref: "."
	scanners: "license"
	exit-code: 1

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
	with:
	sarif_file: "trivy-results.sarif"

Provide feedback