switch default cache paths out of runner tmp

scan-image/README.md

@@ -6,6 +6,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 
 **Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)).
 
+**Bind mounts:** Prefer **`cache-dir`** and **`output-dir`** under **`github.workspace`** (the default cache path does). Paths under **`runner.temp`** can fail on some runners—see [setup-db](../setup-db) README.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -23,7 +25,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
   with:
     image: alpine:3.20
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: image.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -37,7 +39,7 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

scan-image/action.yaml

@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
     required: true