From d20ff7a2435a8b673a13a510b2afbe333c4c3018 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Fri, 28 Aug 2026 23:42:59 +0200
Subject: [PATCH] fix(ci): upgrade pinned Trivy action

---
 .gitea/workflows/ci.yml      | 4 ++--
 .gitea/workflows/release.yml | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index fcd1bcb..bb8e0a9 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
           docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" \
             --tag mobilityops-api-ci --file backend/Dockerfile .
       - name: Production API image vulnerability scan (HIGH/CRITICAL)
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           scan-type: image
           image-ref: mobilityops-api-ci
@@ -46,7 +46,7 @@ jobs:
           docker build --build-arg VCS_REF="$GITHUB_SHA" \
             --tag mobilityops-web-ci frontend
       - name: Production web image vulnerability scan (HIGH/CRITICAL)
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           scan-type: image
           image-ref: mobilityops-web-ci
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 789f5ac..6fa5624 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -24,21 +24,21 @@ jobs:
               --ignore-unfixed --exit-code 1 "$image"
           done
       - name: Generate API CycloneDX SBOM
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           scan-type: image
           image-ref: mobilityops-api-release
           format: cyclonedx
           output: mobilityops-api-sbom.cdx.json
       - name: Generate web CycloneDX SBOM
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           scan-type: image
           image-ref: mobilityops-web-release
           format: cyclonedx
           output: mobilityops-web-sbom.cdx.json
       - name: Generate backup-tools CycloneDX SBOM
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
           scan-type: image
           image-ref: mobilityops-backup-tools-release