### Using Trivy if you don't have code scanning enabled
It's also possible to browse a scan result in a workflow summary.
This step is especially useful for private repositories without [GitHub Advanced Security](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security) license.
```yaml
- name: Run Trivy scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: config
hide-progress: true
output: trivy.txt
- name: Publish Trivy Output to Summary
run: |
if [[ -s trivy.txt ]]; then
{
echo "### Security Output"
echo "<details><summary>Click to expand</summary>"