Comment by cpuguy83

This attack was not mitigated by hash pinning. The setup-trivy action installs the latest version of trivy unless you specify a version.