From c9ae24622ced1112efbe00870205a7280112d6e5 Mon Sep 17 00:00:00 2001
From: amasen02 <amasen02@users.noreply.github.com>
Date: Sat, 12 Sep 2026 21:50:35 +0530
Subject: [PATCH] fix(ci): pin Trivy action to valid release commit

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77c7f8a..3f08c1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,7 +90,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Scan image with Trivy
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
         with:
           image-ref: ghcr.io/${{ github.repository_owner }}/freshcart-web:${{ steps.tags.outputs.shortSha }}
           format: 'sarif'