feat(setup-trivy): use latest as default version (#15)

Using the "latest" released version of Trivy as the default version.
We always first resolve latest to an actual version to allow the cache to work properly.

Reviewed-on: t.behrendt/trivy-actions#15
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

.gitea/workflows/ci.yaml

@@ -16,8 +16,6 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Setup Trivy
         uses: ./setup-trivy
-        with:
-          version: v0.66.0
       - name: Run Trivy
         run: trivy --version
 
@@ -28,8 +26,6 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - uses: ./setup-trivy
-        with:
-          version: v0.66.0
       - name: Setup DB
         id: setup-db
         uses: ./setup-db

setup-db/README.md

@@ -28,8 +28,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Setup Trivy
         uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
-        with:
-          version: "v0.66.0"
       - name: Setup DB
         uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
       - name: Scan for vulnerabilities

setup-trivy/README.md

@@ -10,7 +10,7 @@ A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerab
 - name: Setup Trivy
   uses: your-username/trivy-actions@main/setup-trivy
   with:
-    version: "v0.66.0" # Optional: Trivy version (default: v0.66.0)
+    version: "v0.66.0" # Optional: Trivy version (default: latest)
 ```
 
 ### Complete Example
@@ -28,8 +28,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Setup Trivy
         uses: your-username/trivy-actions@main/setup-trivy
-        with:
-          version: "v0.66.0"
       - name: Scan for vulnerabilities
         run: trivy fs .
 ```
@@ -37,5 +35,5 @@ jobs:
 ## Inputs
 
 | Input     | Description                               | Required | Default  |
-| --------- | ----------------------------------------- | -------- | --------- |
-| `version` | Trivy version to download (e.g., v0.66.0) | No       | `v0.66.0` |
+| --------- | ----------------------------------------- | -------- | -------- |
+| `version` | Trivy version to download (e.g., v0.66.0) | No       | `latest` |

setup-trivy/action.yaml

@@ -9,7 +9,7 @@ inputs:
   version:
     description: "Trivy version to download (e.g., latest)"
     required: false
-    default: "v0.66.0"
+    default: "latest"
 
 runs:
   using: "composite"
@@ -27,21 +27,32 @@ runs:
             ;;
         esac
         echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
+    - name: Resolve version
+      shell: bash
+      id: version
+      run: |
+        set -e
+        if [ "${{ inputs.version }}" = "latest" ]; then
+          VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name')
+        else
+          VERSION="${{ inputs.version }}"
+        fi
+        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
     - name: Cache Trivy binary
       id: cache-trivy
       uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: /usr/local/bin/trivy
-        key: trivy-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
+        key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
         restore-keys: |
-          trivy-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
+          trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
     - name: Download and install Trivy
       if: steps.cache-trivy.outputs.cache-hit != 'true'
       shell: bash
       run: |
         set -e
 
-        VERSION="${{ inputs.version }}"
+        VERSION="${{ steps.version.outputs.version }}"
 
         mkdir -p /usr/local/bin