From 954681c5af5fd7ab10491d0f4b01c443580e8782 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Fri, 10 Apr 2026 19:30:52 +0200 Subject: [PATCH] try again --- scan-config/README.md | 9 ++++++--- scan-config/action.yaml | 7 ++++--- scan-fs/README.md | 6 ++++-- scan-fs/action.yaml | 7 ++++--- scan-image/action.yaml | 7 ++++--- setup-db/README.md | 4 +++- setup-db/action.yaml | 7 +++++-- 7 files changed, 30 insertions(+), 17 deletions(-) diff --git a/scan-config/README.md b/scan-config/README.md index a644475..b67f41b 100644 --- a/scan-config/README.md +++ b/scan-config/README.md @@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca **Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults. +**Docker-in-Docker:** **`cache-dir`** and **`output-dir`** default under **`runner.temp`** so bind mounts work when the job runs in a container with DinD. **`scan-path`** must also be on the same shared volume the Docker daemon uses (often under your runner’s work/temp tree); see [setup-db](../setup-db) README. + ## Prerequisites - Docker on the runner. @@ -23,6 +25,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca uses: ./scan-config with: scan-path: ${{ github.workspace }} + # On DinD, if bind mounts fail, use a path under ${{ runner.temp }} (or your runner’s shared work dir) instead. cache-dir: ${{ steps.db.outputs.cache-dir }} output-dir: ${{ runner.temp }}/trivy-reports output-file: misconfig.sarif @@ -38,8 +41,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | -| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | +| `cache-dir` | Trivy cache directory (read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `output-dir` | Report directory (read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | @@ -53,5 +56,5 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca ## Notes -- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist. +- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing. **`scan-path`** must already exist and be bind-mountable (see DinD note above). - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). diff --git a/scan-config/action.yaml b/scan-config/action.yaml index 7b3d9e2..002567d 100644 --- a/scan-config/action.yaml +++ b/scan-config/action.yaml @@ -10,11 +10,11 @@ inputs: description: "Host path to the directory to scan (mounted read-only at /scan in the container)" required: true cache-dir: - description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" + description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)" required: false default: "${{ runner.temp }}/trivy" output-dir: - description: "Host directory where the report file is written (mounted read-write at /out)" + description: "Report directory (bind-mounted read-write at /out; created if missing)" required: true output-file: description: "SARIF report file name only (no slashes); written under output-dir" @@ -43,12 +43,13 @@ runs: run: | set -euo pipefail case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac + mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN" scan_path=$(realpath "$SCAN_PATH_IN") cache_dir=$(realpath "$CACHE_DIR_IN") - mkdir -p "$OUTPUT_DIR_IN" output_dir=$(realpath "$OUTPUT_DIR_IN") test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } + test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; } docker run --rm \ --name trivy-scan-config \ diff --git a/scan-fs/README.md b/scan-fs/README.md index cd8f644..e3daf1a 100644 --- a/scan-fs/README.md +++ b/scan-fs/README.md @@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca **Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online. +**Docker-in-Docker:** Same bind-mount rules as [scan-config](../scan-config): prefer **`runner.temp`** (defaults) and a **`scan-path`** on the volume shared with DinD—see [setup-db](../setup-db) README. + ## Prerequisites - Docker on the runner. @@ -38,8 +40,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | -| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | +| `cache-dir` | Trivy cache directory (read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `output-dir` | Report directory (read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | diff --git a/scan-fs/action.yaml b/scan-fs/action.yaml index 9c2edeb..5b7505e 100644 --- a/scan-fs/action.yaml +++ b/scan-fs/action.yaml @@ -10,11 +10,11 @@ inputs: description: "Host path to the directory to scan (mounted read-only at /scan in the container)" required: true cache-dir: - description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" + description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)" required: false default: "${{ runner.temp }}/trivy" output-dir: - description: "Host directory where the report file is written (mounted read-write at /out)" + description: "Report directory (bind-mounted read-write at /out; created if missing)" required: true output-file: description: "SARIF report file name only (no slashes); written under output-dir" @@ -43,12 +43,13 @@ runs: run: | set -euo pipefail case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac + mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN" scan_path=$(realpath "$SCAN_PATH_IN") cache_dir=$(realpath "$CACHE_DIR_IN") - mkdir -p "$OUTPUT_DIR_IN" output_dir=$(realpath "$OUTPUT_DIR_IN") test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } + test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; } docker run --rm \ --name trivy-scan-fs \ diff --git a/scan-image/action.yaml b/scan-image/action.yaml index bfaf70a..aca8c5e 100644 --- a/scan-image/action.yaml +++ b/scan-image/action.yaml @@ -10,11 +10,11 @@ inputs: description: "Container image reference to scan (pulled by Trivy inside the container; requires network)" required: true cache-dir: - description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" + description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)" required: false default: "${{ runner.temp }}/trivy" output-dir: - description: "Host directory where the report file is written (mounted read-write at /out)" + description: "Report directory (bind-mounted read-write at /out; created if missing)" required: true output-file: description: "SARIF report file name only (no slashes); written under output-dir" @@ -43,10 +43,11 @@ runs: run: | set -euo pipefail case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac + mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN" cache_dir=$(realpath "$CACHE_DIR_IN") - mkdir -p "$OUTPUT_DIR_IN" output_dir=$(realpath "$OUTPUT_DIR_IN") test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } + test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; } docker run --rm \ --name trivy-scan-image \ diff --git a/setup-db/README.md b/setup-db/README.md index d6028ba..f5c42dc 100644 --- a/setup-db/README.md +++ b/setup-db/README.md @@ -4,6 +4,8 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory. +**Docker-in-Docker:** If the job runs **in a container** and talks to a **DinD sidecar**, bind-mount sources must live on the volume **both** the job and the Docker daemon see. On GitHub-hosted-style setups that is typically under **`RUNNER_TEMP`** (e.g. `/home/runner/_work/_temp`). The default **`cache-dir`** is **`${{ runner.temp }}/trivy`** for that reason—see [this overview of DinD bind mounts](https://dev.to/devactivity/navigating-github-actions-dind-bind-mounts-insights-from-recent-github-reports-for-cicd-1c8). Configure your Gitea runner the same way, or set **`cache-dir`** to a path your platform documents as shared with DinD. + **Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step). ## Usage @@ -40,7 +42,7 @@ jobs: | Input | Description | Required | Default | | ---------------- | --------------------------------------------------------------------------- | -------- | ------- | -| `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` | +| `cache-dir` | Trivy cache directory (created if missing; bind-mounted for DB download) | No | `${{ runner.temp }}/trivy` | | `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` | **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin. diff --git a/setup-db/action.yaml b/setup-db/action.yaml index 8f4ac21..7093d53 100644 --- a/setup-db/action.yaml +++ b/setup-db/action.yaml @@ -7,7 +7,7 @@ branding: inputs: cache-dir: - description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)" + description: "Trivy cache directory on the job filesystem (default under runner.temp—shared with Docker-in-Docker sidecars; bind-mounted into the Trivy container)" required: false default: "${{ runner.temp }}/trivy" trivy-version: @@ -27,6 +27,9 @@ runs: shell: bash run: | echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT + - name: Ensure Trivy cache directory exists + shell: bash + run: mkdir -p "${{ inputs.cache-dir }}" - id: restore-db uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 with: @@ -53,4 +56,4 @@ runs: --security-opt apparmor=docker-default \ --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \ --mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \ - ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache + ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache --offline-scan --exit-code 0