sbx/trivy-kit:20260827-2d26f13b91e884116ff94ea5f1819adbb33b4ec0

schemaVersion: "2"
kind: sandbox
name: trivy
displayName: Trivy
description: Aqua's open source vulnerability scanner — sandboxed because security scanners shouldn't be able to compromise their hosts (TeamPCP, March 2026).
sandbox:
    image: docker/sandbox-templates:shell-docker
    entrypoint:
        - bash
    command:
        default:
            - -l
        interactive:
            - -l
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - github.com
            - objects.githubusercontent.com
            - release-assets.githubusercontent.com
            - mirror.gcr.io
            - ghcr.io
            - pkg-containers.githubusercontent.com
setup:
    install:
        - command: |
            set -euo pipefail
            TRIVY_VERSION=0.70.0
            ARCH=$(dpkg --print-architecture)
            case "$ARCH" in
              amd64)
                TARBALL="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
                SHA256="8b4376d5d6befe5c24d503f10ff136d9e0c49f9127a4279fd110b727929a5aa9"
                ;;
              arm64)
                TARBALL="trivy_${TRIVY_VERSION}_Linux-ARM64.tar.gz"
                SHA256="2f6bb988b553a1bbac6bdd1ce890f5e412439564e17522b88a4541b4f364fc8d"
                ;;
              *)
                echo "unsupported sandbox arch: $ARCH (expected amd64 or arm64)" >&2
                exit 1
                ;;
            esac
            URL="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${TARBALL}"
            curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/trivy.tgz "$URL"
            echo "${SHA256}  /tmp/trivy.tgz" | sha256sum -c -
            tar -C /usr/local/bin -xzf /tmp/trivy.tgz trivy
            rm /tmp/trivy.tgz
            trivy --version
          user: "0"
          description: Install Trivy CLI v0.70.0, version+digest pinned