Pin GitHub Actions to a commit, not a tag

Attackers backdoored the Trivy scanner and rewrote its GitHub Action tags. Pipelines pinned to tags ran the attacker’s code.

20 March 2026 · 1 min read

Yesterday Aqua Security’s Trivy, a popular open-source vulnerability scanner, was compromised. A backdoored release went out, and the attackers force-pushed almost every version tag of the trivy-action GitHub Action to malicious commits. Any pipeline using aquasecurity/trivy-action@v0.x ran code that stole the secrets available to that workflow.

A security scanner was the way in. The irony doesn’t make it less serious.

If you used it in the last few days, treat your CI secrets as stolen and rotate them: cloud keys, registry tokens, deploy keys, package publishing tokens.

For every action you use:

Pin to a full commit SHA, with the version in a comment. Tags can be moved. Commits can’t.
Let Dependabot or Renovate propose updates, and read them.
Give workflows the smallest permissions block, and keep publishing tokens out of jobs that run third-party tools.