The "Trivy Container Image Scanner" step fails before trivy even starts, with a shell syntax error from the generated step script. Other scanner steps work fine in the same environment, so the issue appears specific to this step's script generation (possibly a bash-only construct such as &> or <<< being executed by POSIX sh/ash in the trivy image).

Environment

• OneDev 16.0.8 (Docker image 1dev/server, with /var/run/docker.sock mounted)
• Auto-discovered server docker executor
• Scanner images pulled by the step itself: 1dev/crane:1.0.0, 1dev/trivy:1.0.5

Steps to reproduce

1. Create a project with the following buildspec (no other files needed):

version: 52
jobs:
- name: image-scan
  steps:
  - type: PullImageStep
    name: pull image
    srcImage: node:10-alpine
    destPath: oci
    condition: SUCCESSFUL
    optional: false
  - type: ImageScannerStep
    name: trivy scan
    checkVulnerabilities: true
    scanPath: oci
    failThreshold: HIGH
    reportName: image-vulnerabilities
    publishJSONReportAsArtifact: false
    condition: SUCCESSFUL
    optional: false
  retryCondition: never
  maxRetries: 3
  retryDelay: 30
  timeout: 14400

2. Run the job.

Actual result

The "pull image" step succeeds (OCI layout produced). The trivy step then fails in ~3 seconds, before any scanning output:

Status: Image is up to date for 1dev/trivy:1.0.5
/onedev-build/command/step-1-0.sh: line 20: syntax error: unexpected redirection
Command exited with code 2
Step "trivy scan -> run-trivy-scan" is failed (3 seconds)

What I ruled out

• Not the report name: same failure with reportName image-vulnerabilities and Image Vulnerabilities.
• Not the executor or trivy image: "Trivy Filesystem Scanner" runs fine with the same executor and the same 1dev/trivy:1.0.5 image (scans lock files and publishes its report normally).
• "OSV Source Scanner" also works normally.

So among the Security & Compliance steps, only ImageScannerStep generates a script that ash rejects at line 20.