name: Install verified Trivy
description: Install a pinned native scanner with a checked SHA256.
runs:
  using: composite
  steps:
    - shell: bash
      run: |
        trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
        "$trivy_bin" --version