Can't install latest version by setup-trivy #10152

yukihiko-shinoda · 2026-02-05T10:23:02Z

yukihiko-shinoda
Feb 5, 2026

Description

Nowaday, we have failed to install latest version of aquasecurity/trivy in GitHub Actions by aquasecurity/setup-trivy: Set up your GitHub Actions workflow with a specific version of Trivy
Have anyone removed the latest tag from this repository: aquasecurity/trivy?

The setup-trivy supports for installing the latest version:

https://github.com/aquasecurity/setup-trivy/blob/3fb12ec12f41e471780db15c232d5dd185dcb514/action.yaml#L6-L9

trivy/contrib/install.sh

Lines 73 to 87 in 5ffcdfc

    
           tag_to_version() { 
        
             if [ -z "${TAG}" ]; then 
        
               log_info "checking GitHub for latest tag" 
        
             else 
        
               log_info "checking GitHub for tag '${TAG}'" 
        
             fi 
        
             REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true 
        
             if test -z "$REALTAG"; then 
        
               log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details" 
        
               exit 1 
        
             fi 
        
             # if version starts with 'v', remove it 
        
             TAG="$REALTAG" 
        
             VERSION=${TAG#v} 
        
           }

Desired Behavior

The argument: version: latest is supported

Actual Behavior

Nowaday, we have failed to install Trivy in GitHub Actions:

Run echo "installing Trivy binary"
  echo "installing Trivy binary"
  bash ./trivy/contrib/install.sh -b /home/runner/.local/bin/trivy-bin latest
  cp -r ./trivy/contrib /home/runner/.local/bin/trivy-bin/contrib
  rm -rf ./trivy
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
installing Trivy binary
aquasecurity/trivy info checking GitHub for tag 'latest'
aquasecurity/trivy crit unable to find 'latest' - use 'latest' or see https://github.com/aquasecurity/trivy/releases for details
Error: Process completed with exit code 1.

Reproduction Steps

- uses: aquasecurity/trivy-action@0.33.1
        with:
          scan-type: config
          version: latest

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

Operating System

Version

Checklist

Run trivy clean --all
Read the troubleshooting

DmitriyLewen · 2026-02-05T10:43:24Z

DmitriyLewen
Feb 5, 2026
Maintainer

Hello @yukihiko-shinoda
Can you share link on your pipeline?

It works as expected for me:
https://github.com/DmitriyLewen/test-trivy-action/actions/runs/21708340695/job/62605181197#step:3:121

installing Trivy binary
aquasecurity/trivy info checking GitHub for tag 'latest'
aquasecurity/trivy info found version: 0.69.0 for v0.69.0/Linux/64bit
aquasecurity/trivy info installed /home/runner/.local/bin/trivy-bin/trivy

2 replies

yukihiko-shinoda Feb 6, 2026
Author

@DmitriyLewen This is the full logs including arguments and environment variables for aquasecurity/trivy-action:

2026-02-05 03:39 PM GMT+9 (Click to expand details)

Run aquasecurity/trivy-action@0.33.1
  with:
    exit-code: 1
    output: trivy-results.sarif
    scan-type: config
    token-setup-trivy: ***
    format: sarif
    tf-vars: trivy.terraform.tfvars
    ignore-unfixed: false
    limit-severities-for-sarif: false
    severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
    version: latest
    scan-ref: .
    vuln-type: os,library
    cache-dir: /home/runner/_work/terraform_github/terraform_github/.cache/trivy
    list-all-pkgs: false
    cache: true
    skip-setup-trivy: false
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
Run aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1
  with:
    version: latest
    cache: true
    token: ***
    path: $HOME/.local/bin
    github-server-url: https://github.com/
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
Run echo "dir=$HOME/.local/bin/trivy-bin" >> $GITHUB_OUTPUT
  echo "dir=$HOME/.local/bin/trivy-bin" >> $GITHUB_OUTPUT
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
Run echo "'setup-trivy' doesn't currently support caching the 'latest' version"
  echo "'setup-trivy' doesn't currently support caching the 'latest' version"
  echo "read https://github.com/aquasecurity/setup-trivy?tab=readme-ov-file#caching for more details"
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
'setup-trivy' doesn't currently support caching the 'latest' version
read https://github.com/aquasecurity/setup-trivy?tab=readme-ov-file#caching for more details
Run actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
  with:
    repository: aquasecurity/trivy
    sparse-checkout: contrib
  
    path: trivy
    fetch-depth: 1
    github-server-url: https://github.com/
    token: ***
    ssh-strict: true
    ssh-user: git
    persist-credentials: true
    clean: true
    sparse-checkout-cone-mode: true
    fetch-tags: false
    show-progress: true
    lfs: false
    submodules: false
    set-safe-directory: true
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
Syncing repository: aquasecurity/trivy
Getting Git version info
  Working directory is '/home/runner/_work/terraform_github/terraform_github/trivy'
  /usr/bin/git version
  git version 2.52.0
Temporarily overriding HOME='/home/runner/_work/_temp/d00ea600-a60d-455a-a54f-2d9724ffd6e5' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
/usr/bin/git config --global --add safe.directory /home/runner/_work/terraform_github/terraform_github/trivy
Initializing the repository
  /usr/bin/git init /home/runner/_work/terraform_github/terraform_github/trivy
  hint: Using 'master' as the name for the initial branch. This default branch name
  hint: will change to "main" in Git 3.0. To configure the initial branch name
  hint: to use in all of your new repositories, which will suppress this warning,
  hint: call:
  hint:
  hint: 	git config --global init.defaultBranch <name>
  hint:
  hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
  hint: 'development'. The just-created branch can be renamed via this command:
  hint:
  hint: 	git branch -m <name>
  hint:
  hint: Disable this message with "git config set advice.defaultBranchName false"
  Initialized empty Git repository in /home/runner/_work/terraform_github/terraform_github/trivy/.git/
  /usr/bin/git remote add origin https://github.com/aquasecurity/trivy
Disabling automatic garbage collection
  /usr/bin/git config --local gc.auto 0
Setting up auth
  /usr/bin/git config --local --name-only --get-regexp core\.sshCommand
  /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
  /usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
  /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
  /usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
Determining the default branch
  Retrieving the default branch name
  Default branch 'main'
Fetching the repository
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --filter=blob:none --depth=1 origin +refs/heads/main:refs/remotes/origin/main
  From https://github.com/aquasecurity/trivy
   * [new branch]      main       -> origin/main
Determining the checkout info
Setting up sparse checkout
  /usr/bin/git sparse-checkout set contrib
Checking out the ref
  /usr/bin/git checkout --progress --force -B main refs/remotes/origin/main
  Switched to a new branch 'main'
  branch 'main' set up to track 'origin/main'.
/usr/bin/git log -1 --format=%H
b775a1b63cd7afeda8dec2c1c8b8b6d422418bc6
Run echo "installing Trivy binary"
  echo "installing Trivy binary"
  bash ./trivy/contrib/install.sh -b /home/runner/.local/bin/trivy-bin latest
  cp -r ./trivy/contrib /home/runner/.local/bin/trivy-bin/contrib
  rm -rf ./trivy
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063
installing Trivy binary
aquasecurity/trivy info checking GitHub for tag 'latest'
aquasecurity/trivy crit unable to find 'latest' - use 'latest' or see https://github.com/aquasecurity/trivy/releases for details
Error: Process completed with exit code 1.
Run rm -f trivy_envs.txt
  rm -f trivy_envs.txt
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    TERRAFORM_CLI_PATH: /home/runner/_work/_temp/d3fcd895-22c7-4e65-b1fa-7ff51bd01063

And today (2026-02-06 09:15 AM GMT+9) , I retried actions, it succeed without any errors.

Despite the message" checking GitHub for tag 'latest' aquasecurity/trivy crit unable to find 'latest', I confirmed that latest tag doesn't required since installation code checks following URL:

trivy/contrib/install.sh

Lines 304 to 313 in 5ffcdfc

    
           github_release() { 
        
             owner_repo=$1 
        
             version=$2 
        
             test -z "$version" && version="latest" 
        
             giturl="https://github.com/${owner_repo}/releases/${version}" 
        
             json=$(http_copy "$giturl" "Accept:application/json") 
        
             test -z "$json" && return 1 
        
             version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//') 
        
             test -z "$version" && return 1 
        
             echo "$version"

The following URL seems to work even if the tag: latest doesn't exist:

https://github.com/aquasecurity/trivy/releases/latest

DmitriyLewen Feb 6, 2026
Maintainer

Hi @yukihiko-shinoda
Thanks for the logs.

I don't see any problems...

The only thought I have:
In recent days we've been facing issues with GitHub stability (for example, we can't download a repository archive).
I assume this is a consequence of the serious incident on February 2-3.

In your case, the script couldn't download the list of releases, and due to the fact that the logs are quite generic for the script, we see an error about an incorrect version.

And today (2026-02-06 09:15 AM GMT+9) , I retried actions, it succeed without any errors.

Let's monitor this over the next few days.
Let me know if you continue to have problems.

simar7 · 2026-02-06T05:41:05Z

simar7
Feb 6, 2026
Maintainer

@yukihiko-shinoda just to confirm you don't have any org/repo level security ACLs setup? I'm talking about these in particular https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/

2 replies

yukihiko-shinoda Feb 6, 2026
Author

@simar7 I confirmed that our GitHub Enterprise Server 3.17.7 haven't introduced that function yet:
Enforcing policies for GitHub Actions in your enterprise - GitHub Enterprise Server 3.17 Docs

The function: Require actions to be pinned to a full-length commit SHA is introduced in 3.19:
Enforcing policies for GitHub Actions in your enterprise - GitHub Enterprise Server 3.19 Docs

simar7 Feb 6, 2026
Maintainer

@simar7 I confirmed that our GitHub Enterprise Server 3.17.7 haven't introduced that function yet:

Enforcing policies for GitHub Actions in your enterprise - GitHub Enterprise Server 3.17 Docs

The function: Require actions to be pinned to a full-length commit SHA is introduced in 3.19:

Enforcing policies for GitHub Actions in your enterprise - GitHub Enterprise Server 3.19 Docs

Thanks for confirming. At this time I don't have further ideas but let's keep this discussion going to see if others can chime in.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't install latest version by setup-trivy #10152

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Can't install latest version by setup-trivy #10152

Uh oh!

yukihiko-shinoda Feb 5, 2026

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 2 comments · 4 replies

Uh oh!

DmitriyLewen Feb 5, 2026 Maintainer

Uh oh!

Uh oh!

yukihiko-shinoda Feb 6, 2026 Author

Uh oh!

DmitriyLewen Feb 6, 2026 Maintainer

Uh oh!

simar7 Feb 6, 2026 Maintainer

Uh oh!

yukihiko-shinoda Feb 6, 2026 Author

Uh oh!

simar7 Feb 6, 2026 Maintainer

yukihiko-shinoda
Feb 5, 2026

Replies: 2 comments 4 replies

DmitriyLewen
Feb 5, 2026
Maintainer

yukihiko-shinoda Feb 6, 2026
Author

DmitriyLewen Feb 6, 2026
Maintainer

simar7
Feb 6, 2026
Maintainer

yukihiko-shinoda Feb 6, 2026
Author

simar7 Feb 6, 2026
Maintainer