refactor!: trivy to osv

setup-db/README.md

@@ -1,8 +1,8 @@
 # Setup DB Action
 
-A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
+A reusable Gitea Action that sets up the osv-scanner offline vulnerability database, restoring from cache if available.
 
-**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
+**Note:** This action only sets up the database. osv-scanner itself must be installed separately (e.g., using the `setup-osv` action). Subsequent steps receive `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` via the environment.
 
 ## Usage
 
@@ -10,7 +10,7 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring
 
 ```yaml
 - name: Setup DB
-  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
 ```
 
 ### Complete Example
@@ -26,16 +26,28 @@ jobs:
       - linux_amd64
     steps:
       - uses: actions/checkout@v4
-      - name: Setup Trivy
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
+      - name: Setup OSV Scanner
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-osv@0.0.1
+        with:
+          version: "v2.4.0"
+          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
       - name: Setup DB
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+        id: setup-db
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
       - name: Scan for vulnerabilities
-        run: trivy fs .
+        run: osv-scanner scan source --offline-vulnerabilities -r .
 ```
 
 ## Inputs
 
-| Input       | Description                       | Required | Default          |
-| ----------- | --------------------------------- | -------- | ---------------- |
-| `cache-dir` | Path to the Trivy cache directory | No       | `~/.cache/trivy` |
+| Input         | Description                                                                 | Required | Default                          |
+| ------------- | --------------------------------------------------------------------------- | -------- | -------------------------------- |
+| `cache-dir`   | Path used as `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY`                         | No       | `${{ runner.temp }}/osv-scanner` |
+| `ecosystems`  | Comma-separated OSV ecosystems to download; empty downloads all ecosystems  | No       | _(all)_                          |
+
+## Outputs
+
+| Output      | Description                                      |
+| ----------- | ------------------------------------------------ |
+| `cache-dir` | Path to the osv-scanner local DB cache directory |

setup-db/action.yaml

@@ -1,19 +1,23 @@
-name: "Setup Trivy DB"
-description: "Setup the trivy database, restoring from cache if available"
-author: "Timo Behrendt <t.behrendt@t00n.de"
+name: "Setup OSV Scanner DB"
+description: "Setup the osv-scanner offline vulnerability database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
 branding:
   icon: "database"
   color: "blue"
 
 inputs:
   cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Path used as OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{runner.temp}}/osv-scanner)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ runner.temp }}/osv-scanner"
+  ecosystems:
+    description: "Comma-separated list of OSV ecosystems to download. Empty downloads all ecosystems."
+    required: false
+    default: ""
 
 outputs:
   cache-dir:
-    description: "Path to the Trivy cache directory"
+    description: "Path to the osv-scanner local DB cache directory"
     value: ${{ inputs.cache-dir }}
 
 runs:
@@ -27,9 +31,64 @@ runs:
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ inputs.cache-dir }}
-        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        key: osv-scanner-db-${{ steps.current-date.outputs.current-date }}
         restore-keys: |
-          trivy-db-${{ steps.current-date.outputs.current-date }}
-    - if: steps.restore-db.outputs.cache-hit != 'true'
+          osv-scanner-db-${{ steps.current-date.outputs.current-date }}
+    - name: Download offline databases
+      if: steps.restore-db.outputs.cache-hit != 'true'
       shell: bash
-      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"
+      run: |
+        set -euo pipefail
+
+        CACHE_DIR="${{ inputs.cache-dir }}"
+        DB_DIR="${CACHE_DIR}/osv-scanner"
+        mkdir -p "${DB_DIR}"
+
+        ECOSYSTEMS_INPUT="${{ inputs.ecosystems }}"
+        if [ -n "${ECOSYSTEMS_INPUT}" ]; then
+          # shellcheck disable=SC2001
+          ECOSYSTEMS=$(echo "${ECOSYSTEMS_INPUT}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' || true)
+        else
+          ECOSYSTEMS=$(curl -fsSL https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt | grep -v '^$' | grep -v '^\[EMPTY\]$' || true)
+        fi
+
+        if [ -z "${ECOSYSTEMS}" ]; then
+          echo "No ecosystems to download" >&2
+          exit 1
+        fi
+
+        download_one() {
+          local ecosystem="$1"
+          local encoded
+          encoded=$(printf '%s' "${ecosystem}" | jq -sRr @uri)
+          local dest="${DB_DIR}/${ecosystem}"
+          mkdir -p "${dest}"
+          echo "Downloading ${ecosystem}..."
+          curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/${encoded}/all.zip" -o "${dest}/all.zip"
+        }
+
+        max_jobs=8
+        pids=()
+        while IFS= read -r ecosystem; do
+          [ -z "${ecosystem}" ] && continue
+          while [ "$(jobs -rp | wc -l)" -ge "${max_jobs}" ]; do
+            sleep 0.2
+          done
+          download_one "${ecosystem}" &
+          pids+=("$!")
+        done <<< "${ECOSYSTEMS}"
+
+        fail=0
+        for pid in "${pids[@]}"; do
+          wait "${pid}" || fail=1
+        done
+        if [ "${fail}" -ne 0 ]; then
+          echo "One or more ecosystem database downloads failed" >&2
+          exit 1
+        fi
+
+        echo "Downloaded $(find "${DB_DIR}" -name all.zip | wc -l) ecosystem database(s) to ${DB_DIR}"
+    - name: Export DB cache directory
+      shell: bash
+      run: |
+        echo "OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=${{ inputs.cache-dir }}" >> "$GITHUB_ENV"