Bump aquasecurity/trivy-action from 0.24.0 to 0.29.0 (#1677)

Bumps
[aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action)
from 0.24.0 to 0.29.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aquasecurity/trivy-action/releases">aquasecurity/trivy-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.29.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: Allow skipping setup by <a
href="https://github.com/rvesse"><code>@​rvesse</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/414">aquasecurity/trivy-action#414</a></li>
<li>Fix oras command not found in &quot;Update Trivy Cache&quot; action
by <a href="https://github.com/Tiryoh"><code>@​Tiryoh</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/413">aquasecurity/trivy-action#413</a></li>
<li>Update README.md by <a
href="https://github.com/simar7"><code>@​simar7</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/420">aquasecurity/trivy-action#420</a></li>
<li>feat: add token for <code>setup-trivy</code> by <a
href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a>
in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/421">aquasecurity/trivy-action#421</a></li>
<li>fix: bump <code>setup-trivy</code> and add new <code>contrib</code>
directory path info by <a
href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a>
in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/424">aquasecurity/trivy-action#424</a></li>
<li>docs: remove ignore-unfixed from IaC scan example by <a
href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/429">aquasecurity/trivy-action#429</a></li>
<li>chore(deps): Bump trivy to v0.57.1 by <a
href="https://github.com/simar7"><code>@​simar7</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/434">aquasecurity/trivy-action#434</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/rvesse"><code>@​rvesse</code></a> made
their first contribution in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/414">aquasecurity/trivy-action#414</a></li>
<li><a href="https://github.com/Tiryoh"><code>@​Tiryoh</code></a> made
their first contribution in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/413">aquasecurity/trivy-action#413</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/aquasecurity/trivy-action/compare/0.28.0...0.29.0">https://github.com/aquasecurity/trivy-action/compare/0.28.0...0.29.0</a></p>
<h2>v0.28.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump setup-trivy to v0.2.1 by <a
href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a>
in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/411">aquasecurity/trivy-action#411</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/aquasecurity/trivy-action/compare/0.27.0...0.28.0">https://github.com/aquasecurity/trivy-action/compare/0.27.0...0.28.0</a></p>
<h2>v0.27.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: use <code>setup-trivy</code> to install Trivy by <a
href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a>
in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/406">aquasecurity/trivy-action#406</a></li>
<li>chore: update description for scanners and format inputs by <a
href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/407">aquasecurity/trivy-action#407</a></li>
<li>fix: set envs only when passed by <a
href="https://github.com/knqyf263"><code>@​knqyf263</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/405">aquasecurity/trivy-action#405</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/aquasecurity/trivy-action/compare/0.26.0...0.27.0">https://github.com/aquasecurity/trivy-action/compare/0.26.0...0.27.0</a></p>
<h2>v0.26.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: add usage info about <code>action/cache</code> for trivy
databases by <a
href="https://github.com/DmitriyLewen"><code>@​DmitriyLewen</code></a>
in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/397">aquasecurity/trivy-action#397</a></li>
<li>feat: store artifacts in cache by default by <a
href="https://github.com/knqyf263"><code>@​knqyf263</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/399">aquasecurity/trivy-action#399</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/aquasecurity/trivy-action/compare/0.25.0...0.26.0">https://github.com/aquasecurity/trivy-action/compare/0.25.0...0.26.0</a></p>
<h2>v0.25.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(Makefile): recursive option typo by <a
href="https://github.com/chohner"><code>@​chohner</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/371">aquasecurity/trivy-action#371</a></li>
<li>chore: use checks bundle snapshot from trivy-action by <a
href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/388">aquasecurity/trivy-action#388</a></li>
<li>Upgrade GitHub actions by <a
href="https://github.com/obounaim"><code>@​obounaim</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/374">aquasecurity/trivy-action#374</a></li>
<li>ci: sync trivy-checks version 1 by <a
href="https://github.com/nikpivkin"><code>@​nikpivkin</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/398">aquasecurity/trivy-action#398</a></li>
<li>feat(trivy): Bump to support v0.56.1 by <a
href="https://github.com/simar7"><code>@​simar7</code></a> in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/387">aquasecurity/trivy-action#387</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/chohner"><code>@​chohner</code></a> made
their first contribution in <a
href="https://redirect.github.com/aquasecurity/trivy-action/pull/371">aquasecurity/trivy-action#371</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/18f2510ee396bbf400402947b394f2dd8c87dbb0"><code>18f2510</code></a>
chore(deps): Bump trivy to v0.57.1 (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/434">#434</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/93941cebba762da4c91a91883859bf1bfb221c73"><code>93941ce</code></a>
docs: remove ignore-unfixed from IaC scan example (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/429">#429</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/d2a392a13760cb64cb6bbd31d4bed2a7d9a5298d"><code>d2a392a</code></a>
fix: bump <code>setup-trivy</code> and add new <code>contrib</code>
directory path info (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/424">#424</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/ee8934673cc18947baf4b05c01c4100ff36648da"><code>ee89346</code></a>
feat: add token for <code>setup-trivy</code> (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/421">#421</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/cf990b19d84bbbe1eb8833659989a7c1029132e3"><code>cf990b1</code></a>
Update README.md (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/420">#420</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/bff40be51b9207cf8f2148d628a9836cc7370247"><code>bff40be</code></a>
docs: Fix oras command not found (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/413">#413</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/fc1500abdcdc9fc681e98d8912a52fa70dbc67de"><code>fc1500a</code></a>
feat: Allow skipping setup (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/414">#414</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2"><code>915b19b</code></a>
chore(deps): bump setup-trivy to v0.2.1 (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/411">#411</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/5681af892cd0f4997658e2bacc62bd0a894cf564"><code>5681af8</code></a>
fix: set envs only when passed (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/405">#405</a>)</li>
<li><a
href="https://github.com/aquasecurity/trivy-action/commit/807896715e16054f9ae275ea68a15ee3908f0124"><code>8078967</code></a>
chore: update description for scanners and format inputs (<a
href="https://redirect.github.com/aquasecurity/trivy-action/issues/407">#407</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aquasecurity/trivy-action/compare/6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8...18f2510ee396bbf400402947b394f2dd8c87dbb0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aquasecurity/trivy-action&package-manager=github_actions&previous-version=0.24.0&new-version=0.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

.github/workflows/code_scan.yml

@@ -31,14 +31,14 @@ jobs:
           mkdir -p .ci/base/docs
           pip-compile -o .ci/base/docs/requirements.txt docs/requirements.txt
       - name: Run Trivy Scan (full, csv)
-        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
+        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
         with:
           trivy-config: ".ci/trivy-csv.yaml"
           scan-type: 'fs'
           scan-ref: ".ci/"
           scanners: vuln,secret
       - name: Run Trivy Scan (prod, spdx.json)
-        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
+        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
         with:
           trivy-config: ".ci/trivy-json.yaml"
           scan-type: 'fs'