Normalize the trivy-action version comment to the v-prefixed tag - #64
Normalize the trivy-action version comment to the v-prefixed tag#64jeremy wants to merge 1 commit into
Conversation
trivy-action published both 0.35.0 and v0.35.0, so the bare comment still resolves. It stopped publishing the bare alias at 0.36.0, where only v0.36.0 exists -- so dependabot, which carries the existing comment style forward, writes '# 0.36.0' and zizmor's ref-version-mismatch (new in 1.29.0) flags it as pointing to an unknown ref. That is what fails the audit on #63. Fixing the style here rather than in the bump means dependabot picks up the v-prefix from now on. 57a97c7e is the same commit under both tags, so the pin is unchanged.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Normalizes the Trivy action’s version comment to match its v-prefixed tag without changing the pinned commit.
Changes:
- Updates
0.35.0tov0.35.0, preventing future audit mismatches.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Heads up on the red It fails on Go standard library advisories ( Confirmed it's time-based rather than tree-based: #63's
|
This unblocks the
GitHub Actions auditfailure on #63.aquasecurity/trivy-actionpublished both0.35.0andv0.35.0for that release, so our bare# 0.35.0comment still resolves and main audits clean today. It stopped publishing the bare alias at 0.36.0 — onlyv0.36.0exists:Dependabot carries the existing comment style forward, so on #63 it writes
# 0.36.0, and zizmor'sref-version-mismatch— new in 1.29.0, which #63 pulls in by bumping zizmor-action v0.6.0 → v0.6.2 — correctly flags it as "points to unknown ref ... is pointed to by tag v0.36.0". That single medium finding is the only thing failing #63; its other 15 checks pass.Fixing the style here rather than in the bump is deliberate: dependabot then picks up the
vprefix on this and every future trivy bump, instead of the same finding recurring each time. It also avoids pushing to a Dependabot branch — per the note inbasecamp/.github'sdependabot-sync-actions-comments.yml, any non-Dependabot push to such a PR flips the actor on the retriggeredpull_requestruns and lifts GitHub's Dependabot sandbox over freshly bumped, unreviewed action pins.57a97c7eis the same commit under both tags, so the pin is unchanged — comment only. Verified withzizmor --persona=regular(online) 1.29.0 against this tree: no findings.Once this lands, rebasing #63 should take it green.