From 9a78b3eff495de83035e908305ede5dbea2e8d00 Mon Sep 17 00:00:00 2001 From: null-paorodrigues Date: Fri, 4 Sep 2026 12:48:03 -0300 Subject: [PATCH 1/3] chore: update trivy to 0.74.0 in security scan workflows the previous versions are affected by known trivy advisories (CVE-2026-54448, CVE-2026-55092, CVE-2026-63328, patched in 0.71.x/0.72.0): ecr-security-scan installed 0.69.2 via .deb and docker-security-scan used trivy-action's default 0.70.0. - ecr-security-scan: install 0.74.0 from the release tarball with sha256 verification against the release checksums file - docker-security-scan: pin trivy-action by commit sha and set an explicit trivy version instead of relying on the action default --- .github/workflows/docker-security-scan.yml | 6 ++++-- .github/workflows/ecr-security-scan.yml | 14 +++++++++++--- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/docker-security-scan.yml b/.github/workflows/docker-security-scan.yml index 0af3b00..fc7bc81 100644 --- a/.github/workflows/docker-security-scan.yml +++ b/.github/workflows/docker-security-scan.yml @@ -71,8 +71,9 @@ jobs: - name: Run Trivy vulnerability scanner id: scan - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: + version: 'v0.74.0' image-ref: '${{ inputs.image_name }}:scan' format: 'table' exit-code: '${{ inputs.exit_code }}' @@ -82,8 +83,9 @@ jobs: - name: Generate SARIF report if: inputs.upload_sarif - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: + version: 'v0.74.0' image-ref: '${{ inputs.image_name }}:scan' format: 'sarif' output: 'results.sarif' diff --git a/.github/workflows/ecr-security-scan.yml b/.github/workflows/ecr-security-scan.yml index 8259625..b41da87 100644 --- a/.github/workflows/ecr-security-scan.yml +++ b/.github/workflows/ecr-security-scan.yml @@ -55,10 +55,18 @@ jobs: with: registry-type: public - - name: Install Trivy + - name: Install Trivy (pinned + checksum verified) run: | - wget -q https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.deb - sudo dpkg -i trivy_0.69.2_Linux-64bit.deb + set -euo pipefail + TRIVY_VERSION="0.74.0" + tarball="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" + base="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}" + curl -fsSLO "${base}/${tarball}" + curl -fsSLo trivy_checksums.txt "${base}/trivy_${TRIVY_VERSION}_checksums.txt" + grep " ${tarball}\$" trivy_checksums.txt | sha256sum -c - + tar -xzf "${tarball}" trivy + sudo mv trivy /usr/local/bin/trivy + trivy --version - name: Get latest tags and scan images id: scan From b06503d4c25ce87d748d6668c56f38d88a7b7f52 Mon Sep 17 00:00:00 2001 From: null-paorodrigues Date: Fri, 4 Sep 2026 12:55:00 -0300 Subject: [PATCH 2/3] chore: cover the remaining trivy-action call sites trivy-tofu-scan.yml (2 uses, reusable with callers) and pr-checks-actions.yml (this repo's own pr secret-scan gate) were still running trivy-action's default trivy v0.70.0 via mutable tag; pinned by the same commit sha with explicit version v0.74.0 --- .github/workflows/pr-checks-actions.yml | 3 ++- .github/workflows/trivy-tofu-scan.yml | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-checks-actions.yml b/.github/workflows/pr-checks-actions.yml index b863203..6df4025 100644 --- a/.github/workflows/pr-checks-actions.yml +++ b/.github/workflows/pr-checks-actions.yml @@ -35,8 +35,9 @@ jobs: uses: actions/checkout@v6 - name: Run Trivy secret scan - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: + version: 'v0.74.0' scan-type: 'fs' scan-ref: '.' scanners: 'secret' diff --git a/.github/workflows/trivy-tofu-scan.yml b/.github/workflows/trivy-tofu-scan.yml index 5ab3028..b862b9f 100644 --- a/.github/workflows/trivy-tofu-scan.yml +++ b/.github/workflows/trivy-tofu-scan.yml @@ -38,8 +38,9 @@ jobs: - name: Run Trivy IaC scan if: steps.find.outputs.has_tf_files == 'true' id: scan - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: + version: 'v0.74.0' scan-type: 'config' scan-ref: '.' format: 'json' @@ -51,8 +52,9 @@ jobs: - name: Generate SARIF report if: steps.find.outputs.has_tf_files == 'true' && inputs.upload_sarif - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: + version: 'v0.74.0' scan-type: 'config' scan-ref: '.' format: 'sarif' From d77155a0e7363558a1337fbe7b385185b760b4f6 Mon Sep 17 00:00:00 2001 From: null-paorodrigues Date: Mon, 7 Sep 2026 12:31:44 -0300 Subject: [PATCH 3/3] chore: pin cosign-installer by sha with explicit cosign version the composite installed the action by mutable tag and relied on the installer default cosign (drifts with installer releases); pinned to the v4.1.2 commit sha with cosign v3.1.3 explicit (latest stable, no known advisories) --- .github/actions/sign-image/action.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml index 9aef124..cb3900a 100644 --- a/.github/actions/sign-image/action.yml +++ b/.github/actions/sign-image/action.yml @@ -31,7 +31,11 @@ runs: registry-type: public - name: Install cosign - uses: sigstore/cosign-installer@v4.1.2 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + with: + # Explicit and pinned: the installer's default drifts with its own + # releases; v3.1.3 is the latest stable with no known advisories. + cosign-release: 'v3.1.3' - name: Sign image shell: bash