@master resolves to a version that installs Trivy via a nested
setup-trivy composite action, which does an actions/checkout against
github.com with a token. On Gitea's act_runner that fails with "Input
required and not supplied: token" even when the token is explicitly
set to an empty string (act_runner doesn't distinguish empty from
unset). v0.26.0 introduced that composite/setup-trivy split; v0.25.0
is the last release that ships as a self-contained Docker image with
Trivy already baked in, so it needs no token at all.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
willemjanandClaude Sonnet 5
7379f6be8c