t.behrendt/sec-actions
0
0
Fork 0
Code Issues 2 Pull Requests Actions Activity

remove setup-osv-scanner
CI / Test Setup OSV offline DB (pull_request) Has been cancelled
Details
CI / Test Get Images From Files (pull_request) Has been cancelled
Details
CI / Test Merge SARIF Files (pull_request) Has been cancelled
Details

Browse Source
This commit is contained in:
Timo Behrendt
2026-03-24 21:18:56 +01:00
parent d746e98f30
commit 509ff6db09
5 changed files with 21 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -2
View File
@@ -1,12 +1,11 @@
# OSV-Scanner Actions
Gitea-compatible composite actions for [Google OSV-Scanner](https://github.com/google/osv-scanner): install the CLI, cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests.
Gitea-compatible composite actions around [Google OSV-Scanner](https://github.com/google/osv-scanner): cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. Install the `osv-scanner` CLI from [upstream releases](https://github.com/google/osv-scanner/releases) (or your package manager) in your workflow.
## Actions
| Directory | Purpose |
| ---------------------- | ----------------------------------------------------------------------- |
| `setup-osv-scanner` | Download and cache a pinned `osv-scanner` release (Linux amd64 / arm64), SHA256-verified. |
| `setup-osv-db` | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list. |
| `merge-sarif-files` | Merge multiple SARIF files into one (tool-agnostic). |
| `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). |