Node 20 deprecation warning from trivy-action's internal actions/cache

[lex57ukr]

Goal

Eliminate the Node.js 20 deprecation warning from CI once aquasecurity/trivy-action releases a version that bumps its internal actions/cache from v4 to v5.

Context

The Publish Images and CVE Monitor workflows use aquasecurity/trivy-action@0.35.0 (latest). That action internally depends on actions/cache v4, which runs on Node.js 20. GitHub will force Node 24 starting June 2, 2026 and remove Node 20 on September 16, 2026.

We can't fix this ourselves — the actions/cache pin lives inside trivy-action's action.yml. Dependabot will propose the bump automatically once a new trivy-action release ships with the fix.

Scope

• Monitor https://github.com/aquasecurity/trivy-action releases for an actions/cache v5 bump
• Accept the Dependabot PR when it arrives
• Verify CI runs clean with no Node deprecation warnings

References

• Warning observed in Publish Images run 23686741481
• Affected workflows: publish.yml, cve-monitor.yml
• GitHub deprecation notice