From 04ee3bf86584f7968734b01e1285d48ec3d1ccc8 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 7 Oct 2026 15:42:50 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/workflows/publish-gh-image-and-chart.yml | 2 +-
 .github/workflows/publish-mcr-image.yaml         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-gh-image-and-chart.yml b/.github/workflows/publish-gh-image-and-chart.yml
index 7f8ba792..340d1942 100644
--- a/.github/workflows/publish-gh-image-and-chart.yml
+++ b/.github/workflows/publish-gh-image-and-chart.yml
@@ -95,7 +95,7 @@ jobs:
           REGISTRY: ${{ steps.get-registry.outputs.registry_repository }}
 
       - name: Scan ${{ steps.get-registry.outputs.registry_repository }}/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ steps.get-registry.outputs.registry_repository }}/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
           format: 'table'
diff --git a/.github/workflows/publish-mcr-image.yaml b/.github/workflows/publish-mcr-image.yaml
index e266974c..9f0c2681 100644
--- a/.github/workflows/publish-mcr-image.yaml
+++ b/.github/workflows/publish-mcr-image.yaml
@@ -85,7 +85,7 @@ jobs:
           REGISTRY: ${{ secrets.KAITO_MCR_REGISTRY }}/public/aks/kaito
 
       - name: Scan ${{ secrets.KAITO_MCR_REGISTRY }}/public/aks/kaito/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ secrets.KAITO_MCR_REGISTRY }}/public/aks/kaito/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
           format: 'table'