t.behrendt/sec-actions
0
0
Fork 0
Code Issues 2 Pull Requests Actions Activity

switch default cache paths out of runner tmp
CI / Test Merge SARIF Files (pull_request) Successful in 3s
Details
CI / Test scan-image (pull_request) Failing after 5s
Details
CI / Test scan-config (pull_request) Failing after 5s
Details
CI / Test Setup DB (pull_request) Failing after 7s
Details
CI / Test scan-fs (pull_request) Failing after 16s
Details
CI / Test Get Images From Files (pull_request) Successful in 21s
Details

Browse Source
This commit is contained in:
Timo Behrendt
2026-04-10 19:20:42 +02:00
parent f42efd6245
commit 7d025410e7
10 changed files with 32 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup-db/README.md
+3 -1
View File
@@ -4,6 +4,8 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring
The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
**Bind mounts and paths:** The default **`cache-dir`** is under **`github.workspace`** (`.trivy-cache`), not `${{ runner.temp }}`, because on many self-hosted or containerized runners the Docker daemon does **not** see the same filesystem as the job for `/tmp`—bind mounts then fail with “source path does not exist” even though the shell created the directory. If you set **`cache-dir`** yourself, use a path the Docker daemon can access (typically under the checked-out workspace).
**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
## Usage
@@ -40,7 +42,7 @@ jobs:
| Input | Description | Required | Default |
| --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- |
| `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` |
| `cache-dir` | Path to the Trivy cache directory | No | `${{ github.workspace }}/.trivy-cache` |
| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.