Work around ghcr.io rate limiting for Trivy database downloads

See: * aquasecurity/trivy-action#389 * https://github.com/orgs/community/discussions/139074 Signed-off-by: nscuro <[email protected]>
DependencyTrack · Oct 1, 2024 · d1d5bec · d1d5bec
1 parent 79c5966
commit d1d5bec
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.github/workflows/_meta-build.yaml b/.github/workflows/_meta-build.yaml
@@ -113,6 +113,10 @@ jobs:
       - name: Run Trivy Vulnerability Scanner
         if: ${{ inputs.publish-container }}
         uses: aquasecurity/[email protected]
+        env:
+          # https://github.com/aquasecurity/trivy-action/issues/389
+          TRIVY_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-db:2'
+          TRIVY_JAVA_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-java-db:1'
         with:
           image-ref: docker.io/dependencytrack/frontend:${{ inputs.app-version }}
           format: 'sarif'