fix: cache dir

scan-image/action.yaml

@@ -12,7 +12,7 @@ inputs:
   cache-dir:
     description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
-    default: "${{ runner.temp }}/trivy"
+    default: "${{ github.workspace }}/.trivy-cache"
   output-dir:
     description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
@@ -43,6 +43,7 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
         mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")