From 872c37437bb5ab6702b5b79b8a47f2d37be8dd55 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Wed, 24 Sep 2025 20:45:28 +0200 Subject: [PATCH] initial draft --- .gitea/workflows/cd.yaml | 24 ++++++++++++ .gitea/workflows/ci.yaml | 20 ++++++++++ setup-trivy/README.md | 76 ++++++++++++++++++++++++++++++++++++ setup-trivy/action.yml | 83 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 203 insertions(+) create mode 100644 .gitea/workflows/cd.yaml create mode 100644 .gitea/workflows/ci.yaml create mode 100644 setup-trivy/README.md create mode 100644 setup-trivy/action.yml diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml new file mode 100644 index 0000000..6bd7c1c --- /dev/null +++ b/.gitea/workflows/cd.yaml @@ -0,0 +1,24 @@ +name: CD + +on: + push: + branches: + - main + +jobs: + release: + name: Release + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + with: + fetch-depth: 0 + - name: Increment tag + id: increment-tag + uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.0.10 + with: + token: ${{ secrets.GITEA_TOKEN }} + - name: Push tag + run: | + git tag ${{ steps.increment-tag.outputs.new-tag }} + git push origin ${{ steps.increment-tag.outputs.new-tag }} diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml new file mode 100644 index 0000000..abf09e0 --- /dev/null +++ b/.gitea/workflows/ci.yaml @@ -0,0 +1,20 @@ +name: CI + +on: + pull_request: + +jobs: + dry-run-setup-trivy: + name: Dry-Run Setup Trivy + runs-on: + - ubuntu-latest + - linux-amd64 + steps: + - uses: actions/checkout@v5 + - name: Setup Trivy + uses: ./setup-trivy + with: + version: latest + architecture: amd64 + - name: Run Trivy + run: trivy --version diff --git a/setup-trivy/README.md b/setup-trivy/README.md new file mode 100644 index 0000000..b03e083 --- /dev/null +++ b/setup-trivy/README.md @@ -0,0 +1,76 @@ +# Setup Trivy Action + +A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning. + +## Features + +- 🚀 Easy setup with minimal configuration +- 🔧 Configurable Trivy version and architecture +- ✅ Input validation and error handling +- 🔄 Compatible with Gitea Actions and GitHub Actions +- ⚡ **Smart caching** - Uses native GitHub Actions cache with proper cache-hit detection + +## Usage + +### Basic Usage + +```yaml +- name: Setup Trivy + uses: your-username/trivy-actions@main/setup-trivy +``` + +### Advanced Usage + +```yaml +- name: Setup Trivy + uses: your-username/trivy-actions@main/setup-trivy + with: + version: "v0.57.1" # Optional: Trivy version (default: v0.57.1) + architecture: "amd64" # Optional: amd64 or arm64 (default: amd64) +``` + +### Complete Example + +```yaml +name: Security Scan +on: [push, pull_request] + +jobs: + security: + runs-on: + - ubuntu-latest + - linux-amd64 + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Trivy + uses: your-username/trivy-actions@main/setup-trivy + with: + version: "v0.57.1" + architecture: "amd64" + + - name: Run Trivy vulnerability scanner + run: trivy fs . +``` + +## Action Steps + +The action is structured into logical steps for better maintainability: + +1. **Cache Trivy binary** - Uses `actions/cache@v4` to restore cached binary +2. **Validate inputs** - Validates version and architecture parameters +3. **Download and install Trivy** - Only runs on cache miss, downloads and installs binary +4. **Add Trivy to PATH** - Ensures Trivy is available in subsequent steps +5. **Verify Trivy installation** - Confirms installation and shows version + +## Inputs + +| Input | Description | Required | Default | +| -------------- | ----------------------------------------- | -------- | --------- | +| `version` | Trivy version to download (e.g., v0.57.1) | No | `v0.57.1` | +| `architecture` | System architecture (amd64, arm64) | No | `amd64` | + +## Supported Platforms + +- **Linux**: amd64, arm64 diff --git a/setup-trivy/action.yml b/setup-trivy/action.yml new file mode 100644 index 0000000..1a573aa --- /dev/null +++ b/setup-trivy/action.yml @@ -0,0 +1,83 @@ +name: "Setup Trivy" +description: "Download and setup Trivy binary for vulnerability scanning" +author: "Gitea Actions" +branding: + icon: "shield" + color: "blue" + +inputs: + version: + description: "Trivy version to download (e.g., v0.57.1)" + required: false + default: "v0.57.1" + architecture: + description: "System architecture (amd64, arm64)" + required: false + default: "amd64" + +runs: + using: "composite" + steps: + - name: Cache Trivy binary + id: cache-trivy + uses: actions/cache@v4 + with: + path: /usr/local/bin/trivy + key: trivy-${{ inputs.version }}-${{ inputs.architecture }}-${{ hashFiles('**/action.yml') }} + restore-keys: | + trivy-${{ inputs.version }}-${{ inputs.architecture }}- + trivy-${{ inputs.version }}- + + - name: Validate inputs + shell: bash + run: | + set -e + + VERSION="${{ inputs.version }}" + ARCH="${{ inputs.architecture }}" + + # Validate architecture + case "$ARCH" in + amd64|arm64) + ;; + *) + echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64" + exit 1 + ;; + esac + + - name: Download and install Trivy + if: steps.cache-trivy.outputs.cache-hit != 'true' + shell: bash + run: | + set -e + + VERSION="${{ inputs.version }}" + ARCH="${{ inputs.architecture }}" + + case "$ARCH" in + amd64) + ARCH="64bit" + ;; + arm64) + ARCH="ARM64" + ;; + esac + + mkdir -p /usr/local/bin + + curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${ARCH}.tar.gz" -o trivy.tar.gz + tar -xzf trivy.tar.gz + chmod +x trivy + mv trivy /usr/local/bin/ + rm trivy.tar.gz + + - name: Add Trivy to PATH + shell: bash + run: | + echo "/usr/local/bin" >> $GITHUB_PATH + + - name: Verify Trivy installation + shell: bash + run: | + trivy version