From 0fb7666c0556eabf4bd97ad2f33238a4a4f3de4c Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Tue, 13 Oct 2026 13:22:29 -0700 Subject: [PATCH 1/2] fix(ci): pin Trivy SARIF upload to PR head ref --- .github/workflows/analysis.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 6981532d..1d7f8d0f 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -35,7 +35,16 @@ jobs: scanners: "vuln,secret,config" severity: "CRITICAL,HIGH" + - name: Upload Trivy scan results to GitHub Security tab (PR) + if: always() && github.event_name == 'pull_request' + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: "trivy-results.sarif" + ref: refs/pull/${{ github.event.pull_request.number }}/head + sha: ${{ github.event.pull_request.head.sha }} + - name: Upload Trivy scan results to GitHub Security tab + if: always() && github.event_name != 'pull_request' uses: github/codeql-action/upload-sarif@v4 with: sarif_file: "trivy-results.sarif" From 455d27d538ef1c6fe2ec0f02d662460bea0205ac Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Tue, 13 Oct 2026 13:57:46 -0700 Subject: [PATCH 2/2] fix(ci): check out PR head sha in Trivy scan job --- .github/workflows/analysis.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 1d7f8d0f..9eb06ccc 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -24,6 +24,8 @@ jobs: runs-on: ubuntu-26.04 steps: - uses: actions/checkout@v7 + with: + ref: ${{ github.event.pull_request.head.sha || '' }} - name: Run Trivy vulnerability scanner in repo mode uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0