switch default cache paths out of runner tmp

.gitea/workflows/ci.yaml

@@ -42,8 +42,8 @@ jobs:
         id: fixture
         run: |
           set -euo pipefail
-          scan="${{ runner.temp }}/trivy-ci-scan-config"
-          reports="${{ runner.temp }}/trivy-ci-reports-config"
+          scan="${{ github.workspace }}/.trivy-ci-scan-config"
+          reports="${{ github.workspace }}/.trivy-ci-reports-config"
           mkdir -p "$scan" "$reports"
           printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
           echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
@@ -72,8 +72,8 @@ jobs:
         id: fixture
         run: |
           set -euo pipefail
-          scan="${{ runner.temp }}/trivy-ci-scan-fs"
-          reports="${{ runner.temp }}/trivy-ci-reports-fs"
+          scan="${{ github.workspace }}/.trivy-ci-scan-fs"
+          reports="${{ github.workspace }}/.trivy-ci-reports-fs"
           mkdir -p "$scan" "$reports"
           printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
           echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
@@ -102,7 +102,7 @@ jobs:
         id: fixture
         run: |
           set -euo pipefail
-          reports="${{ runner.temp }}/trivy-ci-reports-image"
+          reports="${{ github.workspace }}/.trivy-ci-reports-image"
           mkdir -p "$reports"
           echo "reports=$reports" >> "$GITHUB_OUTPUT"
       - name: Run scan-image

.gitignore

@@ -0,0 +1,7 @@
+# Default Trivy cache path and CI fixture dirs (under github.workspace)
+/.trivy-cache/
+/.trivy-ci-scan-config/
+/.trivy-ci-reports-config/
+/.trivy-ci-scan-fs/
+/.trivy-ci-reports-fs/
+/.trivy-ci-reports-image/

scan-config/README.md

@@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
 
+**Bind mounts:** Prefer **`cache-dir`**, **`output-dir`**, and **`scan-path`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** (e.g. `/tmp/...`) often work on GitHub-hosted runners but can break when the Docker daemon does not share that mount with the job.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -24,7 +26,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   with:
     scan-path: ${{ github.workspace }}
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: misconfig.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -38,7 +40,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

scan-config/action.yaml

@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
     required: true

scan-fs/README.md

@@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
 
+**Bind mounts:** Prefer **`cache-dir`**, **`output-dir`**, and **`scan-path`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** can fail on some runners—see [setup-db](../setup-db) README.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -24,7 +26,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   with:
     scan-path: ${{ github.workspace }}
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: fs.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -38,7 +40,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

scan-fs/action.yaml

@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
     required: true

scan-image/README.md

@@ -6,6 +6,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 
 **Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)).
 
+**Bind mounts:** Prefer **`cache-dir`** and **`output-dir`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** can fail on some runners—see [setup-db](../setup-db) README.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -23,7 +25,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
   with:
     image: alpine:3.20
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: image.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -37,7 +39,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

scan-image/action.yaml

@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
     required: true

setup-db/README.md

@@ -4,6 +4,8 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring
 
 The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
 
+**Bind mounts and paths:** The default **`cache-dir`** is under **`github.workspace`** (`.trivy-cache`), not `${{ runner.temp }}`, because on many self-hosted or containerized runners the Docker daemon does **not** see the same filesystem as the job for `/tmp`—bind mounts then fail with “source path does not exist” even though the shell created the directory. If you set **`cache-dir`** yourself, use a path the Docker daemon can access (typically under the checked-out workspace).
+
 **Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
 
 ## Usage
@@ -40,7 +42,7 @@ jobs:
 
 | Input           | Description                                               | Required | Default                                                    |
 | --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- |
-| `cache-dir`     | Path to the Trivy cache directory                         | No       | `${{ runner.temp }}/trivy`                                 |
+| `cache-dir`     | Path to the Trivy cache directory                         | No       | `${{ github.workspace }}/.trivy-cache`                   |
 | `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
 
 **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.

setup-db/action.yaml

@@ -7,9 +7,9 @@ branding:
 
 inputs:
   cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Path to the Trivy cache directory (default under github.workspace so Docker bind mounts work on typical runners)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   trivy-version:
     description: "Trivy docker image version to use (full image reference including digest is recommended)"
     required: false