Trivy: a tag is not the image digest

The tag is the name you passed

If you scanned a tag, the report describes the image that tag pointed at during that run. The tag is a movable name. A later pull of the same tag can be different bytes. The row’s package versions are about the image that was read, not about every place the tag has ever pointed.

A digest or image id, when the report prints one, is the identifier to copy. It does not change when someone moves the tag.

A running workload is its own reference

A cluster or a host runs an image id. If that id was not compared to the scan, you do not know that the workload has the package version in the row. Write “digest not compared” rather than “the cluster is affected.” Shared tags are not a comparison.

If the report never printed a digest, write “digest not in the report” and keep the tag labeled as the name you passed. Do not invent an id.

What to file

File the reference you passed, the digest or image id if the report includes it, the scan time, and the package row you are citing. File the workload’s image id separately if you checked it. Do not file a sentence that has only the tag and a claim about production.

Worked case: the tag moved after the scan

Monday’s scan of ghcr.io/hackblue-lab/api:2026.10.2 lists requests 2.31.0. The report’s digest line was not copied into the ticket. On Wednesday the same tag points at a new build. A draft says production is still on 2.31.0 because the tag in the ticket matches the deployment’s tag.

The note says the Monday row is for the image scanned Monday, and the digest was not recorded, so it cannot be matched to the cluster. The tag match is not enough. The package version on the running image is unchecked.

passed to Trivy: ghcr.io/hackblue-lab/api:2026.10.2
scan: Monday
digest in the ticket: not recorded
row: requests 2.31.0
cluster: same tag, image id not compared
write: Monday's scan only
not: production is on 2.31.0