feat: add safely wrapped scan-* workflows

scan-fs/README.md

@@ -0,0 +1,58 @@
+# Trivy scan (filesystem)
+
+Composite action that runs **`trivy filesystem`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
+
+**Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- uses: actions/checkout@v4
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Filesystem scan
+  id: scan
+  uses: ./scan-fs
+  with:
+    scan-path: ${{ github.workspace }}
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: fs.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-fs
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-fs/action.yaml

@@ -0,0 +1,82 @@
+name: "Trivy scan (filesystem)"
+description: "Run trivy filesystem in a locked-down Docker container; report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "search"
+  color: "blue"
+
+inputs:
+  scan-path:
+    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
+    required: true
+  cache-dir:
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Host directory where the report file is written (mounted read-write at /out)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        SCAN_PATH_IN: ${{ inputs.scan-path }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        scan_path=$(realpath "$SCAN_PATH_IN")
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-fs \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --network none \
+          --mount type=bind,src="$scan_path",dst=/scan,ro \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          filesystem /scan \
+          --cache-dir /cache \
+          --skip-db-update \
+          --skip-check-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"