try again

scan-fs/README.md

@@ -6,6 +6,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
 
+**Docker-in-Docker:** Same bind-mount rules as [scan-config](../scan-config): prefer **`runner.temp`** (defaults) and a **`scan-path`** on the volume shared with DinD—see [setup-db](../setup-db) README.
+
 ## Prerequisites
 
 - Docker on the runner.
@@ -38,8 +40,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (read-only at `/cache`; created if missing)            | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Report directory (read-write at `/out`; created if missing)                 | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |