aquasecurity/Aqua Security Trivy installer

Install Trivy binary from release page

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 3, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
version	Trivy version to install	no	latest
path	Path in runner to install Trivy. Trivy will be installed in "<path>/trivy-bin" dir ("$HOME/.local/bin/trivy-bin" by default). Must be a literal path: shell variables (e.g. $HOME, $RUNNER_TEMP) and "~" are NOT expanded. Use a GitHub expression that is resolved before the step runs, or a relative path like "./bins".	no	""
cache	Used to specify whether caching is needed. Set to false, if you would like to disable caching.	no	false
token	Access token used to check out the Trivy repository. The token is required when using GitHub Enterprise Server (GHES). https://github.com/actions/create-github-app-token can be used to obtain such a token. The token should be limited to read access only for public repositories. See more details in https://github.com/aquasecurity/setup-trivy/issues/10	no	${{ github.token }}
github-server-url	The base URL for the GitHub instance to clone aquasecurity/trivy from. Defaults to public https://github.com	no	https://github.com

Outputs

no outputs