name: Install verified Trivy
description: Install a pinned scanner with a checked SHA256, without elevated privileges.
runs:
  using: composite
  steps:
    - shell: bash
      run: |
        set -euo pipefail
        install_dir="$RUNNER_TEMP/trivy-bin"
        mkdir -p "$install_dir"
        curl --fail --silent --show-error --location --retry 3 --max-time 120 \
          https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-64bit.tar.gz \
          --output "$install_dir/trivy.tar.gz"
        echo "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a  $install_dir/trivy.tar.gz" | sha256sum --check --strict
        tar -xzf "$install_dir/trivy.tar.gz" -C "$install_dir" trivy
        echo "$install_dir" >> "$GITHUB_PATH"