Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): Trivy-Action-Referenz existierte nicht (#409)

Browse Source 
aquasecurity/trivy-action@0.29.0 gibt es nicht -- die Tags des
Repositories tragen ein fuehrendes v (v0.29.0). Der Publish-Job brach
deshalb nach sieben Sekunden im Action-Setup ab, noch bevor das Image
gebaut wurde: fuer v0.10.0 liegt kein Image auf ghcr.io.

Jetzt auf den Commit-SHA von v0.36.0 gepinnt statt auf einen Tag. Ein
Tag in einer fremden Action ist verschiebbar, und der Job hat
security-events: write.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ralksta
2026-08-10 09:59:21 +02:00
committed by GitHub
parent 2318409e75
commit 1c9b6f09aa
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/docker-publish.yml vendored
View File

@@ -59,7 +59,10 @@ jobs:
cache-to: type=gha,mode=max cache-to: type=gha,mode=max
- name: Scan image for vulnerabilities - name: Scan image for vulnerabilities
uses: aquasecurity/trivy-action@0.29.0 # Pinned to a commit SHA, not a tag: the action's tags carry a leading
# "v" (v0.36.0), so the previous "@0.29.0" resolved to nothing and the
# job failed at action setup — before the image was ever built.
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with: with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }} image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
format: sarif format: sarif