switch default cache paths out of runner tmp

scan-config/README.md

@@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
 
+**Bind mounts:** Prefer **`cache-dir`**, **`output-dir`**, and **`scan-path`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** (e.g. `/tmp/...`) often work on GitHub-hosted runners but can break when the Docker daemon does not share that mount with the job.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -24,7 +26,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   with:
     scan-path: ${{ github.workspace }}
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: misconfig.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -38,7 +40,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |