trivy-action version 0.34.2 potentially affected by supply chain attack #1752

The problem: On March 19, 2026, trivy-action was the target of CVE-2026-33634 — a supply-chain attack where an attacker force-pushed 76 of 77 version tags to malicious commits. Workflows pinned to @master or any mutable tag were vulnerable during the ~12-hour exposure window. The malicious code exfiltrated CI secrets via GitHub release assets.

The fix: Pinned to the full commit SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 which corresponds to v0.35.0 (the first safe post-incident release). SHA pinning is immune to tag force-pushing — even if tags get hijacked again, the SHA is immutable.