From f89cdd2777ef0f22a6ba30f8b6a72ea188931ec9 Mon Sep 17 00:00:00 2001
From: Casper Van Gheluwe <casper.vangheluwe@imec.be>
Date: Mon, 14 Sep 2026 14:54:54 +0200
Subject: [PATCH] ci: fix Trivy scan workflow

---
 .github/workflows/Trivy-secrete-scan.yaml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/Trivy-secrete-scan.yaml b/.github/workflows/Trivy-secrete-scan.yaml
index 7586112a..cbd48b2d 100644
--- a/.github/workflows/Trivy-secrete-scan.yaml
+++ b/.github/workflows/Trivy-secrete-scan.yaml
@@ -7,6 +7,7 @@ on:
 
 permissions:
   actions: read
+  contents: read
   security-events: write
 
 jobs:
@@ -14,16 +15,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Run Trivy
-        env:
-          TRIVY_IGNORE_UNFIXED: true
-          TRIVY_SEVERITY: CRITICAL
-          TRIVY_FORMAT: sarif
-          TRIVY_OUTPUT: trivy-results.sarif
-        run: |
-          trivy fs --ignore-unfixed --severity CRITICAL --format sarif --output trivy-results.sarif .
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          ignore-unfixed: true
+          severity: CRITICAL
+          format: sarif
+          output: trivy-results.sarif
 
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@v3