refactor!: trivy to osv

.gitea/workflows/ci.yaml

@@ -4,20 +4,24 @@ on:
   pull_request:
 
 jobs:
-  test-setup-trivy:
+  test-setup-osv:
     strategy:
       matrix:
         arch: [amd64, arm64]
-    name: Test Setup Trivy ${{ matrix.arch }}
+    name: Test Setup OSV Scanner ${{ matrix.arch }}
     runs-on:
       - ubuntu-latest
       - linux_${{ matrix.arch }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - name: Setup Trivy
-        uses: ./setup-trivy
-      - name: Run Trivy
-        run: trivy --version
+      - name: Setup OSV Scanner
+        uses: ./setup-osv
+        with:
+          version: v2.4.0
+          amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
+          arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
+      - name: Run osv-scanner
+        run: osv-scanner --version
 
   test-setup-db:
     name: Test Setup DB
@@ -25,12 +29,25 @@ jobs:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./setup-trivy
+      - uses: ./setup-osv
+        with:
+          version: v2.4.0
+          amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
+          arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
       - name: Setup DB
         id: setup-db
         uses: ./setup-db
-      - name: Run Trivy
-        run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
+        with:
+          # Keep CI fast; full ecosystem download is covered by the action default.
+          ecosystems: Go,npm,PyPI
+      - name: Run osv-scanner offline
+        run: |
+          test -n "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}"
+          test "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}" = "${{ steps.setup-db.outputs.cache-dir }}"
+          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/Go/all.zip"
+          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/npm/all.zip"
+          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/PyPI/all.zip"
+          osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles .
 
   test-get-images-from-files:
     name: Test Get Images From Files