Trivy Docker image scanner do not work, when use ubuntu-24.04-arm GitHub Runner #270

Activity

1. DimaBir commented on Jul 28, 2026

   

   Dima Birenbaum (DimaBir)

   on Jul 28, 2026

   Collaborator

   More actions

   Thanks for the report, and for pinning the exact commit — that made this much faster to isolate.

   This is not the action's architecture handling. At c0f73835fa1f80fc12cc96ea7f9185735705f433, the bundled installer correctly resolves Microsoft.Security.Devops.Cli.linux-arm64 when process.arch == 'arm64', and that package is published and installs successfully on ubuntu-24.04-arm. Your run got past install and into tool execution.

   Root cause: one layer down, the MSDO CLI resolves the Trivy tool redist as Microsoft.Guardian.TrivyRedist_linux_amd64.0.69.3 — an x86-64 binary — regardless of host architecture. On aarch64 the exec then fails with Exec format error, which surfaces as the ToolLauncherNotFoundException you saw. The follow-on GuardianFileNotFoundException for .gdntoolsdata is a cascading symptom (the tool never ran, so it never wrote its output), not a separate problem.

   We're tracking the arm64 Trivy redist on the MSDO CLI side.

   Workarounds in the meantime:

   1. Run the scan on an x64 runner (ubuntu-latest). This is the simplest option if the arm runner isn't required for the scan job itself.
   2. Stay on ubuntu-24.04-arm and run Trivy yourself (upstream Trivy ships native arm64 builds), then hand the SARIF to this action for upload:

   - name: Run Trivy
     uses: aquasecurity/trivy-action@master
     with:
       image-ref: your-image:tag
       format: sarif
       output: trivy-results.sarif
   
   - name: Upload to Microsoft Security DevOps
     uses: microsoft/security-devops-action@v1
     with:
       existingFilename: trivy-results.sarif

   We'll update this issue once the arm64 redist is available. Sorry for the delay in responding.

   👍React with 👍1Reacted by Huijin Liu