Marc-André Bombeck a6b150c36e ci(security): pin and verify the Trivy installer ...

The Trivy install step piped a script fetched from a tag straight into a
shell. A tag can be moved to other content, so the job ran whatever the
ref pointed at, with the runner's privileges, and the Scorecard check
flagged it as an unpinned download-then-run.

The script now comes from the commit the tag points at, is checked
against its SHA-256 before it runs, and the binary version stays what it
was.

2026-09-16 13:05:21 +02:00

..

coach-eval.yml

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0

2026-09-13 15:55:28 +00:00

codeql.yml

chore(deps): bump the codeql-action group with 3 updates

2026-09-13 15:54:49 +00:00

dependabot-auto-merge.yml

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0

2026-09-13 15:55:28 +00:00

docker-publish.yml

Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#832)

2026-08-23 18:28:46 +02:00

e2e.yml

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0

2026-09-13 15:55:28 +00:00

env-check.yml

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0

2026-09-13 15:55:28 +00:00

integration.yml

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0

2026-09-13 15:55:28 +00:00

knip.yml

chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0

2026-09-13 15:55:28 +00:00

no-todo-markers.yml

chore(release): fold in the coach discriminant, the dependency bumps, and the notes the audit found wrong

2026-07-26 18:57:21 +02:00

post-publish-verify.yml

build(deps): bump docker/login-action from 4.5.1 to 4.6.0

2026-08-03 11:02:10 +00:00

scorecard.yml

chore(deps): bump the codeql-action group with 3 updates

2026-09-13 15:54:49 +00:00

security.yml

ci(security): pin and verify the Trivy installer

2026-09-16 13:05:21 +02:00

synthetic-journey.yml

fix(ops): refuse a synthetic-journey target that is not ours

2026-09-10 01:25:01 +02:00

trivy.yml

chore(deps): bump the codeql-action group with 3 updates

2026-09-13 15:54:49 +00:00