Trivy Docker image scanner do not work, when use ubuntu-24.04-arm GitHub Runner

[HuijinLiuInforma]

Trivy Docker image scanner do not work, when use ubuntu-24.04-arm GitHub Runner. works when using ubuntu-latest runner. I have updated to version c0f7383, commited on May 7, 2026. Error messages:

ToolLauncherNotFoundException: Could not successfully find the /home/runner/work/_msdo/packages/nuget/Microsoft.Guardian.TrivyRedist_linux_amd64.0.69.3/tools/trivy tool launcher. Please ensure any dependent frameworks are installed.

Error: Win32Exception: An error occurred trying to start process '/home/runner/work/_msdo/packages/nuget/Microsoft.Guardian.TrivyRedist_linux_amd64.0.69.3/tools/trivy' with working directory '/home/runner/work/security-testing/security-testing'. Exec format error

GuardianFileNotFoundException: Unable to find required file at: /home/runner/work/security-testing/security-testing/.gdn/r/.gdntoolsdata

[DimaBir]

Thanks for the report, and for pinning the exact commit — that made this much faster to isolate.

This is not the action's architecture handling. At c0f73835fa1f80fc12cc96ea7f9185735705f433, the bundled installer correctly resolves Microsoft.Security.Devops.Cli.linux-arm64 when process.arch == 'arm64', and that package is published and installs successfully on ubuntu-24.04-arm. Your run got past install and into tool execution.

Root cause: one layer down, the MSDO CLI resolves the Trivy tool redist as Microsoft.Guardian.TrivyRedist_linux_amd64.0.69.3 — an x86-64 binary — regardless of host architecture. On aarch64 the exec then fails with Exec format error, which surfaces as the ToolLauncherNotFoundException you saw. The follow-on GuardianFileNotFoundException for .gdntoolsdata is a cascading symptom (the tool never ran, so it never wrote its output), not a separate problem.

We're tracking the arm64 Trivy redist on the MSDO CLI side.

Workarounds in the meantime:

1. Run the scan on an x64 runner (ubuntu-latest). This is the simplest option if the arm runner isn't required for the scan job itself.
2. Stay on ubuntu-24.04-arm and run Trivy yourself (upstream Trivy ships native arm64 builds), then hand the SARIF to this action for upload:

- name: Run Trivy
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: your-image:tag
    format: sarif
    output: trivy-results.sarif

- name: Upload to Microsoft Security DevOps
  uses: microsoft/security-devops-action@v1
  with:
    existingFilename: trivy-results.sarif

We'll update this issue once the arm64 redist is available. Sorry for the delay in responding.