From e9cb1c2b54472c5f97b742ae2f734b30e110dfcc Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 05:20:28 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/Trivy Scan.yml         | 2 +-
 .github/workflows/release.yml            | 2 +-
 .github/workflows/scan-github-action.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/Trivy Scan.yml b/.github/workflows/Trivy Scan.yml
index 138d25c2..787276d7 100644
--- a/.github/workflows/Trivy Scan.yml	
+++ b/.github/workflows/Trivy Scan.yml	
@@ -27,7 +27,7 @@ jobs:
           IMAGE_TAG: ast-cli:${{ github.sha }}
         run: docker build -t "$IMAGE_TAG" .
       - name: Run Trivy scanner without downloading DBs
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 #v0.35.0
+        uses: step-security/trivy-action@4d04e2d32ba36aae5693467644b22741d68f9115 # v0.36.0
         with:
           scan-type: 'image'
           image-ref: ast-cli:${{ github.sha }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0d512844..abc78d6a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -141,7 +141,7 @@ jobs:
 
       - name: Configure AWS Credentials
         if: inputs.dev == false
-        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 #v2
+        uses: step-security/configure-aws-credentials@1448016543d4432bd608e0de7871c7bf9e9be925 # v6.2.1
         with:
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_ASSUME_ROLE_REGION }}
diff --git a/.github/workflows/scan-github-action.yml b/.github/workflows/scan-github-action.yml
index 3330f7ed..8e6ce9f9 100644
--- a/.github/workflows/scan-github-action.yml
+++ b/.github/workflows/scan-github-action.yml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Run Zizmor linter
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: step-security/zizmor-action@e4ba943ab717e2dc71e7276b8649f48fb7f2519d # v0.5.7
         with:
           advanced-security: false
           annotations: false