fix: cache dir

scan-fs/README.md

@@ -24,7 +24,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   with:
     scan-path: ${{ github.workspace }}
     cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
+    output-dir: ${{ github.workspace }}/trivy-reports
     output-file: fs.sarif
 - name: Upload report
   uses: actions/upload-artifact@v4
@@ -38,7 +38,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ github.workspace }}/.trivy-cache` |
 | `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
@@ -53,6 +53,7 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 ## Notes
 
-- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- Use **`cache-dir`** and **`output-dir`** under **`${{ github.workspace }}`** (or another path the Docker daemon can bind-mount) when the job runs in a container.
+- Paths should exist or be creatable: **`output-dir`** and **`cache-dir`** are created with `mkdir -p` if missing; **`scan-path`** must already exist as a directory.
 - Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).