From 796f8a7659e5042964f53a10d26a362760232ccf Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 20 Aug 2026 02:31:30 -0700 Subject: [PATCH] Normalize the trivy-action version comment to the v-prefixed tag trivy-action published both 0.35.0 and v0.35.0, so the bare comment still resolves. It stopped publishing the bare alias at 0.36.0, where only v0.36.0 exists -- so dependabot, which carries the existing comment style forward, writes '# 0.36.0' and zizmor's ref-version-mismatch (new in 1.29.0) flags it as pointing to an unknown ref. That is what fails the audit on #63. Fixing the style here rather than in the bump means dependabot picks up the v-prefix from now on. 57a97c7e is the same commit under both tags, so the pin is unchanged. --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 025e65b..35cc0e8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -44,7 +44,7 @@ jobs: persist-credentials: false - name: Run Trivy vulnerability scanner (filesystem) - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 with: scan-type: 'fs' scan-ref: '.'