-
Notifications
You must be signed in to change notification settings - Fork 279
Description
Problem
There is an issue with the current action if you run multiple Trivy actions in a row. It will not respect the inputs as it will not set the env var if the env var if the input value is a different value. However, if the env var already has a different value than the default and you try to set it to a default value, it will not work.
Scenario
Here is a scenario: You first run Trivy scan with sarif format, and then you run with table format:
- uses: aquasecurity/trivy-action@0.29.0
with:
image-ref: node:23.2.0-alpine3.20
severity: CRITICAL,HIGH
exit-code: 0
format: sarif
- uses: aquasecurity/trivy-action@0.29.0
with:
image-ref: node:23.2.0-alpine3.20
severity: CRITICAL,HIGH
exit-code: 1
format: table
Then then the second scan will not use format table, as it uses the previously set env var: TRIVY_FORMAT: sarif.
Tests
Here is a workflow run that shows the issue:
input format: table
https://github.com/david-marconis/trivy-ignore-bug/actions/runs/12065562387/job/33644593462#step:3:6
env TRIVY_FORMAT: sarif
https://github.com/david-marconis/trivy-ignore-bug/actions/runs/12065562387/job/33644593462#step:3:20
log indicating sarif mode:
https://github.com/david-marconis/trivy-ignore-bug/actions/runs/12065562387/job/33644593462#step:3:159
Fixed by this PR:
#437