trivy output does not match trivy@1 - Azure DevOps Pipeline

Agent: Ubuntu latest, using Azure DevOps pipelines.

I have been running trivy side by side and found the results in MicrosoftSecurityDevOps@1 to be less than the output results running in trivy@1

The lack of working examples for MicrosoftSecurityDevOps@1 probably doesn't help - it takes me some time to figure out how to use the task and i cant get gdnconfig files to work.

I originally started with this config:

- job: microsoft_security_devops
        continueOnError: false
        steps:
        - task: MicrosoftSecurityDevOps@1
          displayName: 'Microsoft Security DevOps'
          inputs:
            command: 'run' 
            tools: terrascan, trivy

I then created a gdnconfig file and tried to use the

config: '$(System.DefaultWorkingDirectory)/workflows/templates/*.gdnconfig'

I tried loads of variances of the path but every single time it adds a postfix '-linux' to the file name. So the path would turn into:

config: '$(System.DefaultWorkingDirectory)/workflows/templates/*-linux.gdnconfig'

Anyway, the output for the results showed 0 for the MicrosoftSecurityDevOps@1 task and 5 (2 critical, 1 high, and 2 medium) using the trivy@1 task.

I have no confidence in what it showing me and the lack of decent examples and clear documentation is compounding the issue.

Any help appreciated - especially if anyone has got a working example of using trivy, with a gdnconfig file on a Linux agent. 😄

Start by reproducing the Ubuntu Azure DevOps pipeline using MicrosoftSecurityDevOps@1, trivy@1, and the supplied gdnconfig path, then compare both task outputs. Investigate why the config path receives the -linux suffix and why the results differ; done means the behavior is explained or corrected and a working Linux-agent example is documented.