chore(deps): bump aquasecurity/setup-trivy from 0.2.6 to 0.3.0

[dependabot]

Bumps aquasecurity/setup-trivy from 0.2.6 to 0.3.0.

Release notes

Sourced from aquasecurity/setup-trivy's releases.

v0.3.0

v0.3.0

🔒 Security

Hardened the action against shell script injection: ${{ }} values are now passed via env: instead of being inlined into run: blocks, and all shell variables are quoted.

⚠️ Breaking change

The path input must now be a literal path. Shell variables ($HOME, $RUNNER_TEMP) and ~ are no longer expanded and will fail the action.

Only affects you if you explicitly set path with a $ or ~. Default usage is unchanged (Trivy installs to $HOME/.local/bin/trivy-bin), and aquasecurity/trivy-action is not affected.

# ❌ now rejected
path: $RUNNER_TEMP/trivy
✅ use a GitHub expression or a literal path
path: ${{ runner.temp }}/trivy
path: ./bins

Full Changelog: aquasecurity/setup-trivy@v0.2.6...v0.3.0

Commits

• 151a37f fix!: prevent script injection in run blocks (#33)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #72.