try again

scan-config/README.md

@@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
 
+**Docker-in-Docker:** **`cache-dir`** and **`output-dir`** default under **`runner.temp`** so bind mounts work when the job runs in a container with DinD. **`scan-path`** must also be on the same shared volume the Docker daemon uses (often under your runner’s work/temp tree); see [setup-db](../setup-db) README.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -23,6 +25,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   uses: ./scan-config
   with:
     scan-path: ${{ github.workspace }}
+    # On DinD, if bind mounts fail, use a path under ${{ runner.temp }} (or your runner’s shared work dir) instead.
     cache-dir: ${{ steps.db.outputs.cache-dir }}
     output-dir: ${{ runner.temp }}/trivy-reports
     output-file: misconfig.sarif
@@ -38,8 +41,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (read-only at `/cache`; created if missing)            | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Report directory (read-write at `/out`; created if missing)                 | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
 
@@ -53,5 +56,5 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 ## Notes
 
-- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing. **`scan-path`** must already exist and be bind-mountable (see DinD note above).
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-config/action.yaml

@@ -10,11 +10,11 @@ inputs:
     description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
     required: true
   cache-dir:
-    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
+    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
     required: false
     default: "${{ runner.temp }}/trivy"
   output-dir:
-    description: "Host directory where the report file is written (mounted read-write at /out)"
+    description: "Report directory (bind-mounted read-write at /out; created if missing)"
     required: true
   output-file:
     description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,12 +43,13 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
         scan_path=$(realpath "$SCAN_PATH_IN")
         cache_dir=$(realpath "$CACHE_DIR_IN")
-        mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
         test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
         test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
 
         docker run --rm \
           --name trivy-scan-config \