remove setup-osv-scanner

.gitea/workflows/ci.yaml

@@ -4,35 +4,28 @@ on:
   pull_request:
 
 jobs:
-  test-setup-osv-scanner:
-    strategy:
-      matrix:
-        arch: [ amd64, arm64 ]
-    name: Test Setup OSV-Scanner ${{ matrix.arch }}
-    runs-on:
-      - ubuntu-latest
-      - linux_${{ matrix.arch }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup OSV-Scanner
-        uses: ./setup-osv-scanner
-      - name: Run OSV-Scanner
-        run: osv-scanner --version
-
   test-setup-osv-db:
     name: Test Setup OSV offline DB
     runs-on:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./setup-osv-scanner
       - name: Setup offline DB
         id: setup-db
         uses: ./setup-osv-db
-      - name: Run OSV-Scanner with cached DB
+      - name: Verify DB zips exist
-        env:
+        shell: bash
-          OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }}
+        run: |
-        run: osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles -r .
+          set -euo pipefail
+          root="${{ steps.setup-db.outputs.cache-dir }}/osv-scanner"
+          [ -d "$root" ] || { echo "FAIL: missing directory $root"; exit 1; }
+          n=0
+          while IFS= read -r -d '' f; do
+            [ -s "$f" ] || { echo "FAIL: empty or missing: $f"; exit 1; }
+            n=$((n + 1))
+          done < <(find "$root" -type f -name all.zip -print0)
+          [ "$n" -ge 1 ] || { echo "FAIL: no all.zip under $root"; exit 1; }
+          echo "OK: $n non-empty all.zip file(s) under $root"
 
   test-get-images-from-files:
     name: Test Get Images From Files

README.md

@@ -1,12 +1,11 @@
 # OSV-Scanner Actions
 
-Gitea-compatible composite actions for [Google OSV-Scanner](https://github.com/google/osv-scanner): install the CLI, cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests.
+Gitea-compatible composite actions around [Google OSV-Scanner](https://github.com/google/osv-scanner): cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. Install the `osv-scanner` CLI from [upstream releases](https://github.com/google/osv-scanner/releases) (or your package manager) in your workflow.
 
 ## Actions
 
 | Directory              | Purpose                                                                 |
 | ---------------------- | ----------------------------------------------------------------------- |
-| `setup-osv-scanner`    | Download and cache a pinned `osv-scanner` release (Linux amd64 / arm64), SHA256-verified. |
 | `setup-osv-db`         | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list.        |
 | `merge-sarif-files`    | Merge multiple SARIF files into one (tool-agnostic).                  |
 | `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). |

setup-osv-db/README.md

@@ -6,7 +6,7 @@ Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.go
 
 **Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths).
 
-**Note:** This action only prepares the local DB directory. Install the scanner separately (e.g. with the `setup-osv-scanner` action).
+**Note:** This action only prepares the local DB directory. Install the scanner separately.
 
 ## Ecosystems input
 
@@ -33,8 +33,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Setup OSV-Scanner
+      - name: Install OSV-Scanner
-        uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-scanner@0.0.1
+        run: |
+          curl -fsSL -o /usr/local/bin/osv-scanner \
+            "https://github.com/google/osv-scanner/releases/download/v2.3.3/osv-scanner_linux_amd64"
+          chmod +x /usr/local/bin/osv-scanner
+          echo /usr/local/bin >> "$GITHUB_PATH"
       - name: Setup offline DB
         id: setup-db
         uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1

setup-osv-scanner/README.md

@@ -1,47 +0,0 @@
-# Setup OSV-Scanner Action
-
-A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning.
-
-The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`.
-
-When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub.
-
-## Usage
-
-```yaml
-- name: Setup OSV-Scanner
-  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
-  with:
-    version: "v2.3.3"
-    # Optional: override defaults when you change version
-    # sha256_linux_amd64: "..."
-    # sha256_linux_arm64: "..."
-```
-
-## Example workflow
-
-```yaml
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup OSV-Scanner
-        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
-      - name: Scan
-        run: osv-scanner scan source -r .
-```
-
-## Inputs
-
-| Name                  | Description                                                                 | Required | Default (for `v2.3.3`) |
-| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ |
-| `version`             | Git tag of the release to install                                           | No       | `v2.3.3`                 |
-| `sha256_linux_amd64`  | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag             | No       | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` |
-| `sha256_linux_arm64`  | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag             | No       | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` |
-
-## Notes
-
-- Linux runners only (`linux_amd64` / `linux_arm64` release assets).
-- The binary is cached with `actions/cache` by version and architecture.
-- Downloads use `curl -f` so missing releases fail fast.

setup-osv-scanner/action.yaml

@@ -1,78 +0,0 @@
-name: "Setup OSV-Scanner"
-description: "Download and setup the OSV-Scanner binary for vulnerability scanning"
-author: "Gitea Actions"
-branding:
-  icon: "shield"
-  color: "blue"
-
-inputs:
-  version:
-    description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs."
-    required: false
-    default: "v2.3.3"
-  sha256_linux_amd64:
-    description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version"
-    required: false
-    default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033"
-  sha256_linux_arm64:
-    description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version"
-    required: false
-    default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616"
-
-runs:
-  using: "composite"
-  steps:
-    - shell: bash
-      id: arch
-      run: |
-        set -e
-        case "$(uname -m)" in
-          x86_64)
-            ARCH="amd64"
-            ;;
-          aarch64)
-            ARCH="arm64"
-            ;;
-          *)
-            echo "Unsupported architecture: $(uname -m)" >&2
-            exit 1
-            ;;
-        esac
-        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
-    - name: Cache OSV-Scanner binary
-      id: cache-osv
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-      with:
-        path: /usr/local/bin/osv-scanner
-        key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
-        restore-keys: |
-          osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
-    - name: Download and install OSV-Scanner
-      if: steps.cache-osv.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        set -e
-        VERSION="${{ inputs.version }}"
-        ARCH="${{ steps.arch.outputs.arch }}"
-        case "$ARCH" in
-          amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;;
-          arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;;
-          *) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;;
-        esac
-        EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
-        mkdir -p /usr/local/bin
-        tmp="$(mktemp)"
-        trap 'rm -f "$tmp"' EXIT
-        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp"
-        ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
-        if [ "$ACTUAL" != "$EXPECTED" ]; then
-          echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2
-          exit 1
-        fi
-        mv "$tmp" /usr/local/bin/osv-scanner
-        chmod +x /usr/local/bin/osv-scanner
-
-    - name: Add OSV-Scanner to PATH
-      shell: bash
-      run: |
-        echo "/usr/local/bin" >> $GITHUB_PATH