build(deps): Bump aquasecurity/trivy-action from 0.28.0 to 0.36.0 in the actions-minor-and-patch group across 1 directory

[dependabot]

Bumps the actions-minor-and-patch group with 1 update in the / directory: aquasecurity/trivy-action.

Updates aquasecurity/trivy-action from 0.28.0 to 0.36.0

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.36.0

What's Changed

• chore(ci): update bump-trivy workflow by @​DmitriyLewen in aquasecurity/trivy-action#546
• ci: use action.yaml as single source of truth for Trivy version by @​nikpivkin in aquasecurity/trivy-action#552
• ci: replace peter-evans/create-pull-request with gh CLI by @​nikpivkin in aquasecurity/trivy-action#550
• test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @​nikpivkin in aquasecurity/trivy-action#555
• ci: add dependabot config by @​nikpivkin in aquasecurity/trivy-action#556
• chore: add zizmor config by @​nikpivkin in aquasecurity/trivy-action#557
• chore(deps): bump the actions group with 5 updates by @​dependabot[bot] in aquasecurity/trivy-action#558
• fix: use portable shebang in entrypoint.sh by @​Hayao0819 in aquasecurity/trivy-action#545
• Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @​patrik-csak in aquasecurity/trivy-action#547
• Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #549 by @​Aditya09-cse in aquasecurity/trivy-action#548
• chore: use GitHub Actions as git commit author in bump-trivy workflow by @​nikpivkin in aquasecurity/trivy-action#561
• chore(deps): Update trivy to v0.70.0 by @​Argon-DevOps-Mgt in aquasecurity/trivy-action#559
• chore: update action version to v0.36.0 in examples by @​nikpivkin in aquasecurity/trivy-action#563

New Contributors

• @​dependabot[bot] made their first contribution in aquasecurity/trivy-action#558
• @​Hayao0819 made their first contribution in aquasecurity/trivy-action#545
• @​patrik-csak made their first contribution in aquasecurity/trivy-action#547
• @​Aditya09-cse made their first contribution in aquasecurity/trivy-action#548
• @​Argon-DevOps-Mgt made their first contribution in aquasecurity/trivy-action#559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

Release: 0.35.0

What's Changed

• chore(deps): Update trivy to v0.69.3 by @​aqua-bot in aquasecurity/trivy-action#519

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

Release: v0.35.0

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

Release: v0.34.0

Full Changelog: aquasecurity/trivy-action@v0.33.1...v0.34.0

Release: v0.33.1

What's Changed

• Update setup-trivy action to version v0.2.4 by @​martincostello in aquasecurity/trivy-action#486

Full Changelog: aquasecurity/trivy-action@v0.33.0...v0.33.1

... (truncated)

Commits

• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🚀 Release preview

Next version on merge to main: none

semantic-release dry-run output

[3:09:44 AM] [semantic-release] › ℹ  Running semantic-release version 24.2.9
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/changelog"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/npm"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/git"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/github"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "analyzeCommits" from "@semantic-release/commit-analyzer"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "generateNotes" from "@semantic-release/release-notes-generator"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/changelog"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/npm"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/git"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/npm"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/github"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "addChannel" from "@semantic-release/npm"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "addChannel" from "@semantic-release/github"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "success" from "@semantic-release/github"
[3:09:45 AM] [semantic-release] › ✔  Loaded plugin "fail" from "@semantic-release/github"
[3:09:46 AM] [semantic-release] › ℹ  This test run was triggered on the branch refs/pull/1/merge, while semantic-release is configured to only publish from main, therefore a new version won’t be published.

If next_version is none, your commits don't trigger a release. Use feat: for minor, fix: / perf: for patch, or feat!: for major.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.