<!here> Hi everyone, In light of the recently reported _Hackerbot-Claw_ GitHub Actions exploitation campaign, we’ve temporarily disabled GitHub Actions in this repository as a precautionary measure. At this time, we have no indication that our project has been affected or that any secrets or code are at risk. This is a proactive step while we review our workflows and ensure everything is properly hardened. Pull requests can still be opened and reviewed, but CI checks will not run until Actions are re-enabled. We’ll restore normal operations shortly after completing our review. Thanks for your understanding and continued support.

Hi folks, it looks like Trivy got hit again but again we have no indication that it affects our project: • https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release • https://github.com/aquasecurity/trivy/discussions/10420 • https://github.com/aquasecurity/trivy-action/issues/541 We do use the

trivy-action

mentioned but we pin all actions to (un-compromised) SHAs rather than relying on specific version or

latest

tags: https://github.com/fluent/fluent-bit/blob/master/.github/workflows/cron-trivy.yaml We've disabled the specific workflow using it for now just so we can review to confirm. This will not impact anything else other than the automated security reporting we carry out. You can see the latest run from yesterday showing it is not using the compromised commit: https://github.com/fluent/fluent-bit/actions/runs/23304676928/job/67775257912

Run aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
Run aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1

Please check our work by all means (the more eyes the better) and reach out if you have any concerns.

With the Trivy news, I'm momentarily disabling all GH actions for fluent-bit

I think we should do StepSecurity as well, it's free for OSS and had some good recommendations, namely @Steve Hipwell

Do you already scan with Grype (from a Syft SBOM would be idiomatic) in addition to Trivy?

Not yet but I can add it as do that for our agent