From c06a7f3bcd4880e82f1f12faa20710eab1d83cab Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Tue, 13 Oct 2026 13:20:33 -0700 Subject: [PATCH 1/2] fix(ci): pin Trivy SARIF upload to PR head ref --- .github/workflows/analysis.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index fae35480..3eee8a13 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -38,7 +38,16 @@ jobs: scanners: "vuln,secret,config" severity: "CRITICAL,HIGH" + - name: Upload Trivy scan results to GitHub Security tab (PR) + if: always() && github.event_name == 'pull_request' + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: "trivy-results.sarif" + ref: refs/pull/${{ github.event.pull_request.number }}/head + sha: ${{ github.event.pull_request.head.sha }} + - name: Upload Trivy scan results to GitHub Security tab + if: always() && github.event_name != 'pull_request' uses: github/codeql-action/upload-sarif@v4 with: sarif_file: "trivy-results.sarif" From 0253ae3d51432d3bae23abdaeaffce1150209489 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Tue, 13 Oct 2026 13:57:44 -0700 Subject: [PATCH 2/2] fix(ci): check out PR head sha in Trivy scan job --- .github/workflows/analysis.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 3eee8a13..e9f0dc9d 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -27,6 +27,8 @@ jobs: security-events: write steps: - uses: actions/checkout@v7 + with: + ref: ${{ github.event.pull_request.head.sha || '' }} - name: Run Trivy vulnerability scanner in repo mode uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0