Action is not compatible with enforced action pinning

[martincostello]

GitHub has launched a new feature where enterprises/organizations/repositories can enforce that GitHub Actions are pinned by SHA in their Actions settings: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/

If this setting is enabled, then workflows using this action fail to start because the actions/cache action is not pinned by SHA:

trivy-action/action.yaml

Line 142 in 77137e9

uses: actions/cache@v4

Please pin the action and release a new version.

[martincostello]

Could a new release containing this change be released please?