From 463eaebe9f2d24dca2d2b2de45996a70c9cc9ae3 Mon Sep 17 00:00:00 2001
From: Timo Behrendt <t.behrendt@t00n.de>
Date: Sat, 8 Nov 2025 17:31:15 +0100
Subject: [PATCH] feat: add setup-db (#11)

Reviewed-on: https://gitea.t000-n.de/t.behrendt/trivy-actions/pulls/11
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
---
 .gitea/workflows/ci.yaml | 20 ++++++++++++++++++
 setup-db/README.md       | 44 ++++++++++++++++++++++++++++++++++++++++
 setup-db/action.yaml     | 31 ++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+)
 create mode 100644 setup-db/README.md
 create mode 100644 setup-db/action.yaml

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 11d4cd1..83f7839 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -18,3 +18,23 @@ jobs:
           architecture: amd64
       - name: Run Trivy
         run: trivy --version
+
+  test-setup-db:
+    name: Test Setup DB
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./setup-trivy
+        with:
+          version: v0.66.0
+          architecture: amd64
+      - name: Setup DB
+        uses: ./setup-db
+        with:
+          cache-dir: ${{ runner.temp }}/trivy
+      - name: Run Trivy
+        env:
+          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
+        run: trivy fs --skip-db-update .
diff --git a/setup-db/README.md b/setup-db/README.md
new file mode 100644
index 0000000..0f658f3
--- /dev/null
+++ b/setup-db/README.md
@@ -0,0 +1,44 @@
+# Setup DB Action
+
+A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
+
+**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup DB
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+```
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Trivy
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
+        with:
+          version: "v0.66.0"
+          architecture: "amd64"
+      - name: Setup DB
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+      - name: Scan for vulnerabilities
+        run: trivy fs .
+```
+
+## Inputs
+
+| Input       | Description                       | Required | Default          |
+| ----------- | --------------------------------- | -------- | ---------------- |
+| `cache-dir` | Path to the Trivy cache directory | No       | `~/.cache/trivy` |
diff --git a/setup-db/action.yaml b/setup-db/action.yaml
new file mode 100644
index 0000000..e0ec698
--- /dev/null
+++ b/setup-db/action.yaml
@@ -0,0 +1,31 @@
+name: "Setup Trivy DB"
+description: "Setup the trivy database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de"
+branding:
+  icon: "database"
+  color: "blue"
+
+inputs:
+  cache-dir:
+    description: "Path to the Trivy cache directory (default: ~/.cache/trivy)"
+    required: false
+    default: "~/.cache/trivy"
+
+runs:
+  using: "composite"
+  steps:
+    - id: current-date
+      shell: bash
+      run: |
+        echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
+    - id: restore-db
+      uses: actions/cache@v4
+      with:
+        path: ${{ inputs.cache-dir }}
+        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        restore-keys: |
+          trivy-db-${{ steps.current-date.outputs.current-date }}
+          trivy-db-
+    - if: steps.restore-db.outputs.cache-hit != 'true'
+      shell: bash
+      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"