From 7e6dafd8849c4930c6875b9e38ed531f21f2526d Mon Sep 17 00:00:00 2001
From: alovladi007 <83262803+alovladi007@users.noreply.github.com>
Date: Thu, 30 Jul 2026 18:41:40 -0400
Subject: [PATCH] fix(cd): pin trivy-action to a real tag (v0.36.0) + static
 deploy job name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first real CD firing (v0.1.0) failed at job setup on all four builds:
aquasecurity/trivy-action@0.24.0 does not exist — the action's tags are
v-prefixed (verified via the GitHub API; pinned to v0.36.0). Also the
deploy job's name used an event-input expression that renders literally
on tag pushes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/cd.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 506041d..cc5042a 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -108,7 +108,7 @@ jobs:
           provenance: true
 
       - name: Trivy vulnerability scan
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: ${{ env.IMAGE_PREFIX }}/${{ matrix.service.name }}@${{ steps.build.outputs.digest }}
           format: sarif
@@ -189,7 +189,7 @@ jobs:
   # kubeconfig secret. No-ops safely until 5.2 secrets exist in the cluster.
   # ============================================================================
   deploy:
-    name: Deploy (${{ github.event.inputs.environment || 'production' }})
+    name: Deploy
     runs-on: ubuntu-latest
     needs: build-and-push
     environment: