refactor!: trivy to osv

setup-db/action.yaml

@@ -1,19 +1,23 @@
-name: "Setup Trivy DB"
-description: "Setup the trivy database, restoring from cache if available"
-author: "Timo Behrendt <t.behrendt@t00n.de"
+name: "Setup OSV Scanner DB"
+description: "Setup the osv-scanner offline vulnerability database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
 branding:
   icon: "database"
   color: "blue"
 
 inputs:
   cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Path used as OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{runner.temp}}/osv-scanner)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ runner.temp }}/osv-scanner"
+  ecosystems:
+    description: "Comma-separated list of OSV ecosystems to download. Empty downloads all ecosystems."
+    required: false
+    default: ""
 
 outputs:
   cache-dir:
-    description: "Path to the Trivy cache directory"
+    description: "Path to the osv-scanner local DB cache directory"
     value: ${{ inputs.cache-dir }}
 
 runs:
@@ -27,9 +31,64 @@ runs:
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ inputs.cache-dir }}
-        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        key: osv-scanner-db-${{ steps.current-date.outputs.current-date }}
         restore-keys: |
-          trivy-db-${{ steps.current-date.outputs.current-date }}
-    - if: steps.restore-db.outputs.cache-hit != 'true'
+          osv-scanner-db-${{ steps.current-date.outputs.current-date }}
+    - name: Download offline databases
+      if: steps.restore-db.outputs.cache-hit != 'true'
       shell: bash
-      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"
+      run: |
+        set -euo pipefail
+
+        CACHE_DIR="${{ inputs.cache-dir }}"
+        DB_DIR="${CACHE_DIR}/osv-scanner"
+        mkdir -p "${DB_DIR}"
+
+        ECOSYSTEMS_INPUT="${{ inputs.ecosystems }}"
+        if [ -n "${ECOSYSTEMS_INPUT}" ]; then
+          # shellcheck disable=SC2001
+          ECOSYSTEMS=$(echo "${ECOSYSTEMS_INPUT}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' || true)
+        else
+          ECOSYSTEMS=$(curl -fsSL https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt | grep -v '^$' | grep -v '^\[EMPTY\]$' || true)
+        fi
+
+        if [ -z "${ECOSYSTEMS}" ]; then
+          echo "No ecosystems to download" >&2
+          exit 1
+        fi
+
+        download_one() {
+          local ecosystem="$1"
+          local encoded
+          encoded=$(printf '%s' "${ecosystem}" | jq -sRr @uri)
+          local dest="${DB_DIR}/${ecosystem}"
+          mkdir -p "${dest}"
+          echo "Downloading ${ecosystem}..."
+          curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/${encoded}/all.zip" -o "${dest}/all.zip"
+        }
+
+        max_jobs=8
+        pids=()
+        while IFS= read -r ecosystem; do
+          [ -z "${ecosystem}" ] && continue
+          while [ "$(jobs -rp | wc -l)" -ge "${max_jobs}" ]; do
+            sleep 0.2
+          done
+          download_one "${ecosystem}" &
+          pids+=("$!")
+        done <<< "${ECOSYSTEMS}"
+
+        fail=0
+        for pid in "${pids[@]}"; do
+          wait "${pid}" || fail=1
+        done
+        if [ "${fail}" -ne 0 ]; then
+          echo "One or more ecosystem database downloads failed" >&2
+          exit 1
+        fi
+
+        echo "Downloaded $(find "${DB_DIR}" -name all.zip | wc -l) ecosystem database(s) to ${DB_DIR}"
+    - name: Export DB cache directory
+      shell: bash
+      run: |
+        echo "OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=${{ inputs.cache-dir }}" >> "$GITHUB_ENV"