From 7d025410e719831b22a3b9dd0bf09309d2efdda0 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Fri, 10 Apr 2026 19:20:42 +0200 Subject: [PATCH] switch default cache paths out of runner tmp --- .gitea/workflows/ci.yaml | 10 +++++----- .gitignore | 7 +++++++ scan-config/README.md | 6 ++++-- scan-config/action.yaml | 2 +- scan-fs/README.md | 6 ++++-- scan-fs/action.yaml | 2 +- scan-image/README.md | 6 ++++-- scan-image/action.yaml | 2 +- setup-db/README.md | 4 +++- setup-db/action.yaml | 4 ++-- 10 files changed, 32 insertions(+), 17 deletions(-) create mode 100644 .gitignore diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 4ff4e02..9c99ebc 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -42,8 +42,8 @@ jobs: id: fixture run: | set -euo pipefail - scan="${{ runner.temp }}/trivy-ci-scan-config" - reports="${{ runner.temp }}/trivy-ci-reports-config" + scan="${{ github.workspace }}/.trivy-ci-scan-config" + reports="${{ github.workspace }}/.trivy-ci-reports-config" mkdir -p "$scan" "$reports" printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile" echo "scan-path=$scan" >> "$GITHUB_OUTPUT" @@ -72,8 +72,8 @@ jobs: id: fixture run: | set -euo pipefail - scan="${{ runner.temp }}/trivy-ci-scan-fs" - reports="${{ runner.temp }}/trivy-ci-reports-fs" + scan="${{ github.workspace }}/.trivy-ci-scan-fs" + reports="${{ github.workspace }}/.trivy-ci-reports-fs" mkdir -p "$scan" "$reports" printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json" echo "scan-path=$scan" >> "$GITHUB_OUTPUT" @@ -102,7 +102,7 @@ jobs: id: fixture run: | set -euo pipefail - reports="${{ runner.temp }}/trivy-ci-reports-image" + reports="${{ github.workspace }}/.trivy-ci-reports-image" mkdir -p "$reports" echo "reports=$reports" >> "$GITHUB_OUTPUT" - name: Run scan-image diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..c89c327 --- /dev/null +++ b/.gitignore @@ -0,0 +1,7 @@ +# Default Trivy cache path and CI fixture dirs (under github.workspace) +/.trivy-cache/ +/.trivy-ci-scan-config/ +/.trivy-ci-reports-config/ +/.trivy-ci-scan-fs/ +/.trivy-ci-reports-fs/ +/.trivy-ci-reports-image/ diff --git a/scan-config/README.md b/scan-config/README.md index 7c0310d..0d9d3fa 100644 --- a/scan-config/README.md +++ b/scan-config/README.md @@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca **Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults. +**Bind mounts:** Prefer **`cache-dir`**, **`output-dir`**, and **`scan-path`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** (e.g. `/tmp/...`) often work on GitHub-hosted runners but can break when the Docker daemon does not share that mount with the job. + ## Prerequisites - Docker on the runner. @@ -24,7 +26,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca with: scan-path: ${{ github.workspace }} cache-dir: ${{ steps.db.outputs.cache-dir }} - output-dir: ${{ runner.temp }}/trivy-reports + output-dir: ${{ github.workspace }}/trivy-reports output-file: misconfig.sarif - name: Upload report uses: actions/upload-artifact@v4 @@ -38,7 +40,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ github.workspace }}/.trivy-cache` | | `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | diff --git a/scan-config/action.yaml b/scan-config/action.yaml index 8c92fce..109045e 100644 --- a/scan-config/action.yaml +++ b/scan-config/action.yaml @@ -12,7 +12,7 @@ inputs: cache-dir: description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)" required: false - default: "${{ runner.temp }}/trivy" + default: "${{ github.workspace }}/.trivy-cache" output-dir: description: "Host directory where the report file is written (mounted read-write at /out; created if missing)" required: true diff --git a/scan-fs/README.md b/scan-fs/README.md index 1e29d7a..09e4681 100644 --- a/scan-fs/README.md +++ b/scan-fs/README.md @@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca **Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online. +**Bind mounts:** Prefer **`cache-dir`**, **`output-dir`**, and **`scan-path`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** can fail on some runners—see [setup-db](../setup-db) README. + ## Prerequisites - Docker on the runner. @@ -24,7 +26,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca with: scan-path: ${{ github.workspace }} cache-dir: ${{ steps.db.outputs.cache-dir }} - output-dir: ${{ runner.temp }}/trivy-reports + output-dir: ${{ github.workspace }}/trivy-reports output-file: fs.sarif - name: Upload report uses: actions/upload-artifact@v4 @@ -38,7 +40,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ github.workspace }}/.trivy-cache` | | `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | diff --git a/scan-fs/action.yaml b/scan-fs/action.yaml index 08f2138..02c19ef 100644 --- a/scan-fs/action.yaml +++ b/scan-fs/action.yaml @@ -12,7 +12,7 @@ inputs: cache-dir: description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)" required: false - default: "${{ runner.temp }}/trivy" + default: "${{ github.workspace }}/.trivy-cache" output-dir: description: "Host directory where the report file is written (mounted read-write at /out; created if missing)" required: true diff --git a/scan-image/README.md b/scan-image/README.md index 409e7f5..46b5dc0 100644 --- a/scan-image/README.md +++ b/scan-image/README.md @@ -6,6 +6,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv **Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)). +**Bind mounts:** Prefer **`cache-dir`** and **`output-dir`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** can fail on some runners—see [setup-db](../setup-db) README. + ## Prerequisites - Docker on the runner. @@ -23,7 +25,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv with: image: alpine:3.20 cache-dir: ${{ steps.db.outputs.cache-dir }} - output-dir: ${{ runner.temp }}/trivy-reports + output-dir: ${{ github.workspace }}/trivy-reports output-file: image.sarif - name: Upload report uses: actions/upload-artifact@v4 @@ -37,7 +39,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `image` | Image reference to scan (pulled inside the container) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ github.workspace }}/.trivy-cache` | | `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | diff --git a/scan-image/action.yaml b/scan-image/action.yaml index 40dd3ec..8390747 100644 --- a/scan-image/action.yaml +++ b/scan-image/action.yaml @@ -12,7 +12,7 @@ inputs: cache-dir: description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)" required: false - default: "${{ runner.temp }}/trivy" + default: "${{ github.workspace }}/.trivy-cache" output-dir: description: "Host directory where the report file is written (mounted read-write at /out; created if missing)" required: true diff --git a/setup-db/README.md b/setup-db/README.md index 60d899c..95c811a 100644 --- a/setup-db/README.md +++ b/setup-db/README.md @@ -4,6 +4,8 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory. +**Bind mounts and paths:** The default **`cache-dir`** is under **`github.workspace`** (`.trivy-cache`), not `${{ runner.temp }}`, because on many self-hosted or containerized runners the Docker daemon does **not** see the same filesystem as the job for `/tmp`—bind mounts then fail with “source path does not exist” even though the shell created the directory. If you set **`cache-dir`** yourself, use a path the Docker daemon can access (typically under the checked-out workspace). + **Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step). ## Usage @@ -40,7 +42,7 @@ jobs: | Input | Description | Required | Default | | --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- | -| `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` | +| `cache-dir` | Path to the Trivy cache directory | No | `${{ github.workspace }}/.trivy-cache` | | `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` | **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin. diff --git a/setup-db/action.yaml b/setup-db/action.yaml index 3393614..80623ac 100644 --- a/setup-db/action.yaml +++ b/setup-db/action.yaml @@ -7,9 +7,9 @@ branding: inputs: cache-dir: - description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)" + description: "Path to the Trivy cache directory (default under github.workspace so Docker bind mounts work on typical runners)" required: false - default: "${{ runner.temp }}/trivy" + default: "${{ github.workspace }}/.trivy-cache" trivy-version: description: "Trivy docker image version to use (full image reference including digest is recommended)" required: false