[aig-hannes]

Why

.github/workflows/_install_dev_tools.bash added Aqua's apt repository (aquasecurity.github.io/trivy-repo/deb) and ran apt-get install trivy with no version. Every job then ran whatever Trivy release apt resolved at that moment. This is the path of the March 2026 Trivy compromise, in the same file and lines. Renovate cannot see apt installs, so the org's 5-day release-age wait did not apply. The script runs in audit, lint, test, docs, package-publish, Claude Code and four scheduled workflows. This is the last open item of OP-3653 for this repo.

This is a security fix, so it fits the maintenance-mode rules.

What

• Remove the Aqua apt key, the apt source and trivy from the apt-get install line. The other packages still come from Ubuntu.
• Download Trivy v0.76.1 (released 2026-10-21, the version that aignostics/actions also pins) from GitHub releases. Check the SHA-256 of the tarball against a value in the script before Trivy goes on the PATH. There is a checksum for x86_64 and one for ARM64, because the test matrix also runs this script on ubuntu-24.04-arm. Any other architecture fails.
• A # renovate: comment lets the org's annotated version manager propose updates. Renovate does not update the checksums, so its PR fails the check until someone copies the new values from trivy_<version>_checksums.txt. That stop is intended.

The repo is public, so it cannot use the internal aignostics/actions/install_trivy action. That is why the check is in the script.

Tested

• bash -n and shellcheck: no findings.
• Local run of the download and checksum block for x86_64 and ARM64: both tarballs pass the check and contain trivy.
• CI of this PR runs the full script on ubuntu-latest and ubuntu-24.04-arm.

The script also installs Sentry CLI with wget … | sh. That is a separate problem and not part of this PR.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch fix/pin-trivy-install → main

View scan in OX Security →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 17 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[aig-hannes]

@olivermeyer thanks for merging. One follow-up about renovate.json, from the supply chain tracker (OP-3653).

The tracker checker still marks python-sdk as "Renovate not correctly configured". It flags the last package rule:

"matchPackageNames": ["*"],
"enabled": false

The checker accepts an enabled: false rule only when the rule has a description and is limited to named packages or files. This rule has a description, but * matches every package, so the check fails.

The description and commit bcc094b say this is deliberate: the SDK is deprecated and gets only security fixes and the weekly lock file maintenance. If that is correct, nothing in the repo has to change. We will add python-sdk as an accepted exception in the tracker, with a link to this comment.

One side effect to know about: with every package disabled, Renovate no longer updates the SHA pins of the GitHub Actions and pre-commit hooks, or the Trivy version in _install_dev_tools.bash. Those get no update PR unless an advisory triggers one. If that is acceptable until the SDK is retired, please reply "keep the rule". If you want the pins to stay current, the rule can exclude the github-actions and pre-commit managers.