refactor!: to osv-scanner (#51)

Reviewed-on: #51 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
2026-07-18 10:24:01 +02:00
parent 1e5381502a
commit 368e1be8dd
8 changed files with 274 additions and 138 deletions
@@ -1,8 +1,8 @@
 # Setup DB Action

-A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
+A reusable Gitea Action that sets up the osv-scanner offline vulnerability database, restoring from cache if available.

-**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
+**Note:** This action only sets up the database. osv-scanner itself must be installed separately (e.g., using the `setup-osv` action). Subsequent steps receive `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` via the environment.

 ## Usage

@@ -10,7 +10,7 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring

 ```yaml
 - name: Setup DB
-  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
 ```

 ### Complete Example
@@ -26,16 +26,28 @@ jobs:
      - linux_amd64
    steps:
      - uses: actions/checkout@v4
-      - name: Setup Trivy
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
+      - name: Setup OSV Scanner
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-osv@0.0.1
+        with:
+          version: "v2.4.0"
+          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
      - name: Setup DB
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+        id: setup-db
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
      - name: Scan for vulnerabilities
-        run: trivy fs .
+        run: osv-scanner scan source --offline-vulnerabilities -r .
 ```

 ## Inputs

-| Input       | Description                       | Required | Default          |
-| ----------- | --------------------------------- | -------- | ---------------- |
-| `cache-dir` | Path to the Trivy cache directory | No       | `~/.cache/trivy` |
+| Input         | Description                                                                 | Required | Default                          |
+| ------------- | --------------------------------------------------------------------------- | -------- | -------------------------------- |
+| `cache-dir`   | Path used as `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY`                         | No       | `${{ runner.temp }}/osv-scanner` |
+| `ecosystems`  | Comma-separated OSV ecosystems to download; empty downloads all ecosystems  | No       | _(all)_                          |
+
+## Outputs
+
+| Output      | Description                                      |
+| ----------- | ------------------------------------------------ |
+| `cache-dir` | Path to the osv-scanner local DB cache directory |
@@ -1,19 +1,23 @@
-name: "Setup Trivy DB"
-description: "Setup the trivy database, restoring from cache if available"
-author: "Timo Behrendt <t.behrendt@t00n.de"
+name: "Setup OSV Scanner DB"
+description: "Setup the osv-scanner offline vulnerability database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
 branding:
  icon: "database"
  color: "blue"

 inputs:
  cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Path used as OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{runner.temp}}/osv-scanner)"
    required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ runner.temp }}/osv-scanner"
+  ecosystems:
+    description: "Comma-separated list of OSV ecosystems to download. Empty downloads all ecosystems."
+    required: false
+    default: ""

 outputs:
  cache-dir:
-    description: "Path to the Trivy cache directory"
+    description: "Path to the osv-scanner local DB cache directory"
    value: ${{ inputs.cache-dir }}

 runs:
@@ -27,9 +31,64 @@ runs:
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ${{ inputs.cache-dir }}
-        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        key: osv-scanner-db-${{ steps.current-date.outputs.current-date }}
        restore-keys: |
-          trivy-db-${{ steps.current-date.outputs.current-date }}
-    - if: steps.restore-db.outputs.cache-hit != 'true'
+          osv-scanner-db-${{ steps.current-date.outputs.current-date }}
+    - name: Download offline databases
+      if: steps.restore-db.outputs.cache-hit != 'true'
      shell: bash
-      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"
+      run: |
+        set -euo pipefail
+
+        CACHE_DIR="${{ inputs.cache-dir }}"
+        DB_DIR="${CACHE_DIR}/osv-scanner"
+        mkdir -p "${DB_DIR}"
+
+        ECOSYSTEMS_INPUT="${{ inputs.ecosystems }}"
+        if [ -n "${ECOSYSTEMS_INPUT}" ]; then
+          # shellcheck disable=SC2001
+          ECOSYSTEMS=$(echo "${ECOSYSTEMS_INPUT}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' || true)
+        else
+          ECOSYSTEMS=$(curl -fsSL https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt | grep -v '^$' | grep -v '^\[EMPTY\]$' || true)
+        fi
+
+        if [ -z "${ECOSYSTEMS}" ]; then
+          echo "No ecosystems to download" >&2
+          exit 1
+        fi
+
+        download_one() {
+          local ecosystem="$1"
+          local encoded
+          encoded=$(printf '%s' "${ecosystem}" | jq -sRr @uri)
+          local dest="${DB_DIR}/${ecosystem}"
+          mkdir -p "${dest}"
+          echo "Downloading ${ecosystem}..."
+          curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/${encoded}/all.zip" -o "${dest}/all.zip"
+        }
+
+        max_jobs=8
+        pids=()
+        while IFS= read -r ecosystem; do
+          [ -z "${ecosystem}" ] && continue
+          while [ "$(jobs -rp | wc -l)" -ge "${max_jobs}" ]; do
+            sleep 0.2
+          done
+          download_one "${ecosystem}" &
+          pids+=("$!")
+        done <<< "${ECOSYSTEMS}"
+
+        fail=0
+        for pid in "${pids[@]}"; do
+          wait "${pid}" || fail=1
+        done
+        if [ "${fail}" -ne 0 ]; then
+          echo "One or more ecosystem database downloads failed" >&2
+          exit 1
+        fi
+
+        echo "Downloaded $(find "${DB_DIR}" -name all.zip | wc -l) ecosystem database(s) to ${DB_DIR}"
+    - name: Export DB cache directory
+      shell: bash
+      run: |
+        echo "OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=${{ inputs.cache-dir }}" >> "$GITHUB_ENV"