From 7275b46707f5b4794bfcff46c1318f06d3ef9959 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:51:18 +0200
Subject: [PATCH] chore(ci): repin trivy-action to a resolvable tag (#12257)

---
 .github/actions/trivy-scan/action.yml      | 4 ++--
 .github/workflows/api-container-checks.yml | 4 +++-
 .github/workflows/mcp-container-checks.yml | 4 +++-
 .github/workflows/sdk-container-checks.yml | 1 +
 .github/workflows/ui-container-checks.yml  | 4 +++-
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml
index b7b758fb64..c908a20049 100644
--- a/.github/actions/trivy-scan/action.yml
+++ b/.github/actions/trivy-scan/action.yml
@@ -54,7 +54,7 @@ runs:
           trivy-db-${{ runner.os }}-
 
     - name: Run Trivy vulnerability scan (JSON)
-      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
       with:
         image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
         format: 'json'
@@ -67,7 +67,7 @@ runs:
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
       with:
         image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
         format: 'sarif'
diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml
index 0e6609286f..c540b6e533 100644
--- a/.github/workflows/api-container-checks.yml
+++ b/.github/workflows/api-container-checks.yml
@@ -105,7 +105,9 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: api/**
+          files: |
+            api/**
+            .github/actions/trivy-scan/**
           files_ignore: |
             api/docs/**
             api/README.md
diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml
index 94cb740457..c8a1830501 100644
--- a/.github/workflows/mcp-container-checks.yml
+++ b/.github/workflows/mcp-container-checks.yml
@@ -98,7 +98,9 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: mcp_server/**
+          files: |
+            mcp_server/**
+            .github/actions/trivy-scan/**
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml
index 1e2e092dbc..aba7ee98bf 100644
--- a/.github/workflows/sdk-container-checks.yml
+++ b/.github/workflows/sdk-container-checks.yml
@@ -113,6 +113,7 @@ jobs:
             pyproject.toml
             uv.lock
             .github/workflows/sdk-container-checks.yml
+            .github/actions/trivy-scan/**
           files_ignore: |
             prowler/CHANGELOG.md
             prowler/changelog.d/**
diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml
index 14988ef203..05a3a8e3e0 100644
--- a/.github/workflows/ui-container-checks.yml
+++ b/.github/workflows/ui-container-checks.yml
@@ -99,7 +99,9 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: ui/**
+          files: |
+            ui/**
+            .github/actions/trivy-scan/**
           files_ignore: |
             ui/CHANGELOG.md
             ui/changelog.d/**