scope permissions and pin version

canonical · Jul 1, 2024 · 08b35a4 · 08b35a4
1 parent 56013ae
commit 08b35a4
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
@@ -11,14 +11,15 @@ jobs:
     strategy:
       matrix:
         branch: [master]
-    permissions: write-all
+    permissions:
+      security-events: write
     steps:
       - name: Checking out repo
         uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@0.23.0
         with:
           scan-type: "fs"
           ignore-unfixed: true