Jannis Braun
cf4172e81a
v0.28.0's composite action referenced a nested aquasecurity/setup-trivy@v0.2.1 tag that no longer exists, so the action failed to RESOLVE during job setup (before any step ran) — continue-on-error can't catch a resolution failure, so both Trivy jobs went red on every run. v0.36.0 pins setup-trivy to a real SHA (v0.2.6) and still supports scan-type/scan-ref/scanners/format/output.