refactor!: trivy to osv

setup-osv/README.md

@@ -0,0 +1,51 @@
+# Setup OSV Scanner Action
+
+A reusable Gitea Action that downloads and sets up the osv-scanner binary for vulnerability scanning.
+
+The downloaded binary is verified against a pinned SHA-256 digest for the runner architecture.
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup OSV Scanner
+  uses: your-username/osv-scanner-actions@main/setup-osv
+  with:
+    version: "v2.4.0"
+    amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+    arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
+```
+
+Digests are published in each release's `osv-scanner_SHA256SUMS` file (e.g. for `osv-scanner_linux_amd64` / `osv-scanner_linux_arm64`). You may pass either bare hex or `sha256:<hex>`.
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV Scanner
+        uses: your-username/osv-scanner-actions@main/setup-osv
+        with:
+          version: "v2.4.0"
+          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
+      - name: Scan for vulnerabilities
+        run: osv-scanner scan source -r .
+```
+
+## Inputs
+
+| Input          | Description                                                          | Required | Default |
+| -------------- | -------------------------------------------------------------------- | -------- | ------- |
+| `version`      | Explicit osv-scanner release tag (e.g. `v2.4.0`). `latest` is rejected | Yes      | —       |
+| `amd64-digest` | SHA-256 of `osv-scanner_linux_amd64` (hex or `sha256:<hex>`)         | Yes      | —       |
+| `arm64-digest` | SHA-256 of `osv-scanner_linux_arm64` (hex or `sha256:<hex>`)         | Yes      | —       |

setup-osv/action.yaml

@@ -0,0 +1,104 @@
+name: "Setup OSV Scanner"
+description: "Download and setup osv-scanner binary for vulnerability scanning"
+author: "Gitea Actions"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "osv-scanner version to download (e.g., v2.4.0). Must be an explicit release tag; 'latest' is not allowed."
+    required: true
+  amd64-digest:
+    description: "SHA-256 digest of the linux amd64 binary (hex or sha256:<hex>)"
+    required: true
+  arm64-digest:
+    description: "SHA-256 digest of the linux arm64 binary (hex or sha256:<hex>)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Resolve architecture and digest
+      shell: bash
+      id: arch
+      run: |
+        set -euo pipefail
+
+        VERSION="${{ inputs.version }}"
+        if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then
+          echo "version must be an explicit release tag (e.g. v2.4.0); 'latest' is not allowed" >&2
+          exit 1
+        fi
+
+        case "$(uname -m)" in
+          x86_64)
+            ARCH="amd64"
+            DIGEST="${{ inputs.amd64-digest }}"
+            ;;
+          aarch64)
+            ARCH="arm64"
+            DIGEST="${{ inputs.arm64-digest }}"
+            ;;
+          *)
+            echo "Unsupported architecture: $(uname -m)" >&2
+            exit 1
+            ;;
+        esac
+
+        if [ -z "${DIGEST}" ]; then
+          echo "Missing digest for architecture ${ARCH}" >&2
+          exit 1
+        fi
+
+        # Normalize sha256:<hex> / SHA256:<hex> to bare hex
+        DIGEST="${DIGEST#sha256:}"
+        DIGEST="${DIGEST#SHA256:}"
+
+        if ! [[ "${DIGEST}" =~ ^[a-fA-F0-9]{64}$ ]]; then
+          echo "Invalid ${ARCH} digest (expected 64-char hex or sha256:<hex>): ${DIGEST}" >&2
+          exit 1
+        fi
+
+        echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
+        echo "DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT"
+        echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+    - name: Cache osv-scanner binary
+      id: cache-osv
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: /usr/local/bin/osv-scanner
+        key: osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
+        restore-keys: |
+          osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
+    - name: Download and install osv-scanner
+      if: steps.cache-osv.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        VERSION="${{ steps.arch.outputs.version }}"
+        ARCH="${{ steps.arch.outputs.arch }}"
+        EXPECTED_DIGEST="${{ steps.arch.outputs.digest }}"
+        DEST="/usr/local/bin/osv-scanner"
+
+        mkdir -p /usr/local/bin
+
+        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "${DEST}"
+
+        ACTUAL_DIGEST=$(sha256sum "${DEST}" | awk '{print $1}')
+        if [ "${ACTUAL_DIGEST}" != "${EXPECTED_DIGEST}" ]; then
+          echo "Digest mismatch for osv-scanner ${VERSION} (linux_${ARCH})" >&2
+          echo "  expected: ${EXPECTED_DIGEST}" >&2
+          echo "  actual:   ${ACTUAL_DIGEST}" >&2
+          rm -f "${DEST}"
+          exit 1
+        fi
+
+        chmod +x "${DEST}"
+        echo "Verified osv-scanner ${VERSION} (linux_${ARCH}) digest ${ACTUAL_DIGEST}"
+
+    - name: Add osv-scanner to PATH
+      shell: bash
+      run: |
+        echo "/usr/local/bin" >> "$GITHUB_PATH"