Security Alert: Compromised Aqua Security Trivy Action (v0.69.4 and possibly others)

[mnkiefer]

• A confirmed compromise has been identified in Aqua Security’s Trivy GitHub Action (v0.69.4), with potential impact extending to additional versions.
• Only v0.35.0 and v0.2.6 are currently verified as safe.
• Immediate steps:
  • Stop using affected or unverified versions
  • Pin workflows to a safe version
  • Review recent pipeline runs for suspicious activity

[mnkiefer]

• Done in chore: bump trivy-action from 0.33.1 to 0.35.0 #22003