From d746e98f302f7848b9ad6c9dd8d5715de8495714 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Tue, 24 Mar 2026 21:15:45 +0100 Subject: [PATCH] sync --- .gitea/workflows/ci.yaml | 28 +++--- README.md | 22 ++++- get-images-from-files/README.md | 6 +- merge-sarif-files/README.md | 4 +- merge-sarif-files/test_sarif1.json | 6 +- merge-sarif-files/test_sarif2.json | 6 +- renovate.json | 1 - setup-db/README.md | 41 --------- setup-db/action.yaml | 35 ------- setup-osv-db/README.md | 67 ++++++++++++++ setup-osv-db/action.yaml | 143 +++++++++++++++++++++++++++++ setup-osv-scanner/README.md | 47 ++++++++++ setup-osv-scanner/action.yaml | 78 ++++++++++++++++ setup-trivy/README.md | 39 -------- setup-trivy/action.yaml | 68 -------------- 15 files changed, 381 insertions(+), 210 deletions(-) delete mode 100644 setup-db/README.md delete mode 100644 setup-db/action.yaml create mode 100644 setup-osv-db/README.md create mode 100644 setup-osv-db/action.yaml create mode 100644 setup-osv-scanner/README.md create mode 100644 setup-osv-scanner/action.yaml delete mode 100644 setup-trivy/README.md delete mode 100644 setup-trivy/action.yaml diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index aa635ed..35bfeb3 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -4,33 +4,35 @@ on: pull_request: jobs: - test-setup-trivy: + test-setup-osv-scanner: strategy: matrix: arch: [ amd64, arm64 ] - name: Test Setup Trivy ${{ matrix.arch }} + name: Test Setup OSV-Scanner ${{ matrix.arch }} runs-on: - ubuntu-latest - linux_${{ matrix.arch }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Trivy - uses: ./setup-trivy - - name: Run Trivy - run: trivy --version + - name: Setup OSV-Scanner + uses: ./setup-osv-scanner + - name: Run OSV-Scanner + run: osv-scanner --version - test-setup-db: - name: Test Setup DB + test-setup-osv-db: + name: Test Setup OSV offline DB runs-on: - ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: ./setup-trivy - - name: Setup DB + - uses: ./setup-osv-scanner + - name: Setup offline DB id: setup-db - uses: ./setup-db - - name: Run Trivy - run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} . + uses: ./setup-osv-db + - name: Run OSV-Scanner with cached DB + env: + OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }} + run: osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles -r . test-get-images-from-files: name: Test Get Images From Files diff --git a/README.md b/README.md index ae0b575..bfcce44 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,21 @@ -# Trivy Actions +# OSV-Scanner Actions -Gitea compatible actions related to Trivy or the Trivy ecosystem. +Gitea-compatible composite actions for [Google OSV-Scanner](https://github.com/google/osv-scanner): install the CLI, cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. + +## Actions + +| Directory | Purpose | +| ---------------------- | ----------------------------------------------------------------------- | +| `setup-osv-scanner` | Download and cache a pinned `osv-scanner` release (Linux amd64 / arm64), SHA256-verified. | +| `setup-osv-db` | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list. | +| `merge-sarif-files` | Merge multiple SARIF files into one (tool-agnostic). | +| `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). | + +## Workflows + +- **CI** (`.gitea/workflows/ci.yaml`): tests the actions above on `pull_request`. +- **CD / Prerelease**: tag bump workflows unchanged (no scanner). + +## Documentation + +Each action directory has its own `README.md` with inputs, outputs, and examples. diff --git a/get-images-from-files/README.md b/get-images-from-files/README.md index b8db6d0..4d52568 100644 --- a/get-images-from-files/README.md +++ b/get-images-from-files/README.md @@ -1,6 +1,6 @@ # Get Images From Files Action -A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated. +A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated. Use the list with `osv-scanner scan image ` (or a loop in CI) to scan container images. **Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged. @@ -21,7 +21,7 @@ Other files are supported if they use one of these patterns (e.g. `image:` or `F ```yaml - name: Get Images From Files - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1 + uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1 with: files: | - Dockerfile @@ -42,7 +42,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: Get Images From Files - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1 + uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1 with: files: | - Dockerfile diff --git a/merge-sarif-files/README.md b/merge-sarif-files/README.md index 4ded285..df9d61c 100644 --- a/merge-sarif-files/README.md +++ b/merge-sarif-files/README.md @@ -10,7 +10,7 @@ A reusable Gitea Action that merges multiple SARIF files into a single SARIF fil ```yaml - name: Merge SARIF Files - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1 + uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1 with: files: | - test_sarif1.json @@ -30,7 +30,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: Merge SARIF Files - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1 + uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1 with: files: | - test_sarif1.json diff --git a/merge-sarif-files/test_sarif1.json b/merge-sarif-files/test_sarif1.json index 17a3601..c178990 100644 --- a/merge-sarif-files/test_sarif1.json +++ b/merge-sarif-files/test_sarif1.json @@ -5,9 +5,9 @@ { "tool": { "driver": { - "fullName": "Trivy Vulnerability Scanner", - "informationUri": "https://github.com/aquasecurity/trivy", - "name": "Trivy", + "fullName": "OSV-Scanner", + "informationUri": "https://github.com/google/osv-scanner", + "name": "OSV-Scanner", "rules": [ { "id": "KSV-0014", diff --git a/merge-sarif-files/test_sarif2.json b/merge-sarif-files/test_sarif2.json index 5ae4188..5ae95de 100644 --- a/merge-sarif-files/test_sarif2.json +++ b/merge-sarif-files/test_sarif2.json @@ -5,9 +5,9 @@ { "tool": { "driver": { - "fullName": "Trivy Vulnerability Scanner", - "informationUri": "https://github.com/aquasecurity/trivy", - "name": "Trivy", + "fullName": "OSV-Scanner", + "informationUri": "https://github.com/google/osv-scanner", + "name": "OSV-Scanner", "rules": [ { "id": "CVE-2026-26019", diff --git a/renovate.json b/renovate.json index 75c1077..f8e40d3 100644 --- a/renovate.json +++ b/renovate.json @@ -1,7 +1,6 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "local>t.behrendt/renovate-configs:common", "local>t.behrendt/renovate-configs:action" ], "packageRules": [ diff --git a/setup-db/README.md b/setup-db/README.md deleted file mode 100644 index 4f59fa2..0000000 --- a/setup-db/README.md +++ /dev/null @@ -1,41 +0,0 @@ -# Setup DB Action - -A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available. - -**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action). - -## Usage - -### Basic Usage - -```yaml -- name: Setup DB - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1 -``` - -### Complete Example - -```yaml -name: Security Scan -on: [push, pull_request] - -jobs: - security: - runs-on: - - ubuntu-latest - - linux_amd64 - steps: - - uses: actions/checkout@v4 - - name: Setup Trivy - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1 - - name: Setup DB - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1 - - name: Scan for vulnerabilities - run: trivy fs . -``` - -## Inputs - -| Input | Description | Required | Default | -| ----------- | --------------------------------- | -------- | ---------------- | -| `cache-dir` | Path to the Trivy cache directory | No | `~/.cache/trivy` | diff --git a/setup-db/action.yaml b/setup-db/action.yaml deleted file mode 100644 index 889f3bd..0000000 --- a/setup-db/action.yaml +++ /dev/null @@ -1,35 +0,0 @@ -name: "Setup Trivy DB" -description: "Setup the trivy database, restoring from cache if available" -author: "Timo Behrendt > $GITHUB_OUTPUT - - id: restore-db - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 - with: - path: ${{ inputs.cache-dir }} - key: trivy-db-${{ steps.current-date.outputs.current-date }} - restore-keys: | - trivy-db-${{ steps.current-date.outputs.current-date }} - - if: steps.restore-db.outputs.cache-hit != 'true' - shell: bash - run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}" diff --git a/setup-osv-db/README.md b/setup-osv-db/README.md new file mode 100644 index 0000000..67e217a --- /dev/null +++ b/setup-osv-db/README.md @@ -0,0 +1,67 @@ +# Setup OSV offline DB Action + +A reusable Gitea Action that restores or populates the [OSV-Scanner local vulnerability cache](https://google.github.io/osv-scanner/usage/offline-mode/) used with `--offline-vulnerabilities`. + +Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.googleapis.com/` as described under [Manual database download](https://google.github.io/osv-scanner/usage/offline-mode/#manual-database-download): for each requested ecosystem, download `…//all.zip` into `osv-scanner//all.zip`. **OSV-Scanner is not invoked** for downloads. + +**Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths). + +**Note:** This action only prepares the local DB directory. Install the scanner separately (e.g. with the `setup-osv-scanner` action). + +## Ecosystems input + +Use **`ecosystems`**: a comma-separated list (spaces around commas are trimmed). Each token is matched to an entry from [ecosystems.txt](https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt) by: + +- **Slug match:** lowercased, spaces → `-`, brackets removed (e.g. `GitHub Actions` and `github-actions` both match). +- **Special case:** `docker` is not an OSV ecosystem; it is treated as **`Linux`** (useful as a default when scanning image-related data). Override with `Alpine`, `Debian`, etc. if you prefer. + +The **`actions/cache` key includes** the sorted, slugified list of resolved ecosystems (e.g. `github-actions,go,linux,npm`) plus the hour bucket settings, so different ecosystem sets never share a cache entry. + +## Usage + +```yaml +uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1 +with: + ecosystems: PyPI,npm,Go +``` + +## Example workflow + +```yaml +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Setup OSV-Scanner + uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-scanner@0.0.1 + - name: Setup offline DB + id: setup-db + uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1 + with: + cache-bucket-hours: 6 + ecosystems: github-actions,npm,go,Alpine + - name: Scan (offline vulnerabilities only) + env: + OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }} + run: osv-scanner scan source --offline-vulnerabilities -r . +``` + +## Inputs + +| Name | Description | Required | Default | +| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------- | +| `cache-dir` | Directory for `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` | No | `${{ runner.temp }}/osv-scanner` | +| `cache-bucket-hours` | `actions/cache` primary key includes `floor(UTC unix time / (3600 × N))`. | No | `24` | +| `ecosystems` | Comma-separated tokens (names/slugs; `docker` → `Linux`). | No | `github-actions,npm,go,docker` | + +## Outputs + +| Name | Description | +| ----------- | ------------------ | +| `cache-dir` | Same as input path | + +## Behavior + +- **Cache:** Key pattern `osv-scanner-db-{hours}h-eco-{sorted-slugs}-{bucket}`. `restore-keys` reuse the newest cache for the same hours + ecosystem set when the current time bucket misses. +- **Populate:** On cache miss, `${cache-dir}/osv-scanner` is recreated and only the requested ecosystems are downloaded. diff --git a/setup-osv-db/action.yaml b/setup-osv-db/action.yaml new file mode 100644 index 0000000..cb78ffe --- /dev/null +++ b/setup-osv-db/action.yaml @@ -0,0 +1,143 @@ +name: "Setup OSV offline vulnerability DB" +description: "Populate or restore the OSV-Scanner local vulnerability database cache (offline mode)" +author: "Timo Behrendt " +branding: + icon: "database" + color: "blue" + +inputs: + cache-dir: + description: "Directory for OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{ runner.temp }}/osv-scanner)" + required: false + default: "${{ runner.temp }}/osv-scanner" + cache-bucket-hours: + description: "actions/cache key advances every this many full hours (UTC, since epoch). Example: 24 ≈ daily bucket; 1 = new key each hour." + required: false + default: "24" + ecosystems: + description: "Comma-separated ecosystem tokens (slug or official name, see README). OSV has no Docker Hub bucket; token `docker` installs the `Linux` ecosystem as a practical default for image-style data." + required: false + default: "github-actions,npm,go,docker" + +outputs: + cache-dir: + description: "Path passed to OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY" + value: ${{ inputs.cache-dir }} + +runs: + using: "composite" + steps: + - id: prepare + shell: bash + run: | + set -euo pipefail + + slugify() { + local s="$1" + s=$(printf '%s' "$s" | tr '[:upper:]' '[:lower:]') + s=$(printf '%s' "$s" | sed 's/\[//g;s/\]//g') + s=$(printf '%s' "$s" | sed 's/[[:space:]]\+/-/g') + printf '%s' "$s" + } + + HOURS="${{ inputs.cache-bucket-hours }}" + case "$HOURS" in + ''|*[!0-9]*) echo "cache-bucket-hours must be a positive integer, got: $HOURS" >&2; exit 1 ;; + esac + if [ "$HOURS" -lt 1 ]; then + echo "cache-bucket-hours must be >= 1" >&2 + exit 1 + fi + bucket=$(( $(date -u +%s) / (3600 * HOURS) )) + echo "hours=$HOURS" >> "$GITHUB_OUTPUT" + echo "bucket=$bucket" >> "$GITHUB_OUTPUT" + + RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}" + RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt" + : > "$RESOLVED_FILE" + + ecosystems_all="$(mktemp)" + curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt" -o "$ecosystems_all" + + declare -A SLUG_TO_OFFICIAL=() + while IFS= read -r line || [ -n "$line" ]; do + line="${line//$'\r'/}" + [ -z "$line" ] && continue + slug=$(slugify "$line") + SLUG_TO_OFFICIAL["$slug"]="$line" + done < "$ecosystems_all" + rm -f "$ecosystems_all" + + declare -A SEEN_CANONICAL=() + INPUT="${{ inputs.ecosystems }}" + INPUT="${INPUT//$'\r'/}" + if [ -z "${INPUT//[[:space:]]/}" ]; then + echo "ecosystems input is empty" >&2 + exit 1 + fi + + IFS=',' read -ra PARTS <<< "$INPUT" + for raw in "${PARTS[@]}"; do + token=$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') + [ -z "$token" ] && continue + tslug=$(slugify "$token") + if [ "$tslug" = "docker" ]; then + official="Linux" + elif [ -n "${SLUG_TO_OFFICIAL[$tslug]+x}" ]; then + official="${SLUG_TO_OFFICIAL[$tslug]}" + else + echo "Unknown ecosystem token: ${token}. Valid names/slugs match https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt (token docker -> Linux)." >&2 + exit 1 + fi + if [ -z "${SEEN_CANONICAL[$official]+x}" ]; then + SEEN_CANONICAL[$official]=1 + printf '%s\n' "$official" >> "$RESOLVED_FILE" + fi + done + + if [ ! -s "$RESOLVED_FILE" ]; then + echo "No ecosystems resolved from input" >&2 + exit 1 + fi + + slug_keys=() + while IFS= read -r official || [ -n "$official" ]; do + [ -z "$official" ] && continue + slug_keys+=("$(slugify "$official")") + done < "$RESOLVED_FILE" + ecosystems_key=$(printf '%s\n' "${slug_keys[@]}" | sort -u | paste -sd, -) + echo "ecosystems-key=$ecosystems_key" >> "$GITHUB_OUTPUT" + - id: restore-db + uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 + with: + path: ${{ inputs.cache-dir }} + key: osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-${{ steps.prepare.outputs.bucket }} + restore-keys: | + osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}- + - if: steps.restore-db.outputs.cache-hit != 'true' + shell: bash + run: | + set -euo pipefail + CACHE_DIR="${{ inputs.cache-dir }}" + ROOT="${CACHE_DIR}/osv-scanner" + BASE="https://osv-vulnerabilities.storage.googleapis.com" + RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}" + RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt" + + rm -rf "$ROOT" + mkdir -p "$ROOT" + + if [ ! -s "$RESOLVED_FILE" ]; then + echo "Missing resolved ecosystem list at $RESOLVED_FILE" >&2 + exit 1 + fi + + while IFS= read -r ecosystem || [ -n "$ecosystem" ]; do + [ -z "$ecosystem" ] && continue + enc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$ecosystem")" + dest_dir="${ROOT}/${ecosystem}" + mkdir -p "$dest_dir" + tmp="$(mktemp)" + curl -fsSL "${BASE}/${enc}/all.zip" -o "$tmp" + mv "$tmp" "${dest_dir}/all.zip" + done < "$RESOLVED_FILE" diff --git a/setup-osv-scanner/README.md b/setup-osv-scanner/README.md new file mode 100644 index 0000000..c290eeb --- /dev/null +++ b/setup-osv-scanner/README.md @@ -0,0 +1,47 @@ +# Setup OSV-Scanner Action + +A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning. + +The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`. + +When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub. + +## Usage + +```yaml +- name: Setup OSV-Scanner + uses: your-username/osv-scanner-actions@main/setup-osv-scanner + with: + version: "v2.3.3" + # Optional: override defaults when you change version + # sha256_linux_amd64: "..." + # sha256_linux_arm64: "..." +``` + +## Example workflow + +```yaml +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Setup OSV-Scanner + uses: your-username/osv-scanner-actions@main/setup-osv-scanner + - name: Scan + run: osv-scanner scan source -r . +``` + +## Inputs + +| Name | Description | Required | Default (for `v2.3.3`) | +| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ | +| `version` | Git tag of the release to install | No | `v2.3.3` | +| `sha256_linux_amd64` | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag | No | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` | +| `sha256_linux_arm64` | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag | No | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` | + +## Notes + +- Linux runners only (`linux_amd64` / `linux_arm64` release assets). +- The binary is cached with `actions/cache` by version and architecture. +- Downloads use `curl -f` so missing releases fail fast. diff --git a/setup-osv-scanner/action.yaml b/setup-osv-scanner/action.yaml new file mode 100644 index 0000000..152c391 --- /dev/null +++ b/setup-osv-scanner/action.yaml @@ -0,0 +1,78 @@ +name: "Setup OSV-Scanner" +description: "Download and setup the OSV-Scanner binary for vulnerability scanning" +author: "Gitea Actions" +branding: + icon: "shield" + color: "blue" + +inputs: + version: + description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs." + required: false + default: "v2.3.3" + sha256_linux_amd64: + description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version" + required: false + default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033" + sha256_linux_arm64: + description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version" + required: false + default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616" + +runs: + using: "composite" + steps: + - shell: bash + id: arch + run: | + set -e + case "$(uname -m)" in + x86_64) + ARCH="amd64" + ;; + aarch64) + ARCH="arm64" + ;; + *) + echo "Unsupported architecture: $(uname -m)" >&2 + exit 1 + ;; + esac + echo "ARCH=$ARCH" >> $GITHUB_OUTPUT + - name: Cache OSV-Scanner binary + id: cache-osv + uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 + with: + path: /usr/local/bin/osv-scanner + key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }} + restore-keys: | + osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }} + - name: Download and install OSV-Scanner + if: steps.cache-osv.outputs.cache-hit != 'true' + shell: bash + run: | + set -e + VERSION="${{ inputs.version }}" + ARCH="${{ steps.arch.outputs.arch }}" + case "$ARCH" in + amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;; + arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;; + *) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;; + esac + EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]') + mkdir -p /usr/local/bin + tmp="$(mktemp)" + trap 'rm -f "$tmp"' EXIT + curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp" + ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]') + if [ "$ACTUAL" != "$EXPECTED" ]; then + echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2 + exit 1 + fi + mv "$tmp" /usr/local/bin/osv-scanner + chmod +x /usr/local/bin/osv-scanner + + - name: Add OSV-Scanner to PATH + shell: bash + run: | + echo "/usr/local/bin" >> $GITHUB_PATH diff --git a/setup-trivy/README.md b/setup-trivy/README.md deleted file mode 100644 index 78e877f..0000000 --- a/setup-trivy/README.md +++ /dev/null @@ -1,39 +0,0 @@ -# Setup Trivy Action - -A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning. - -## Usage - -### Basic Usage - -```yaml -- name: Setup Trivy - uses: your-username/trivy-actions@main/setup-trivy - with: - version: "v0.66.0" # Optional: Trivy version (default: latest) -``` - -### Complete Example - -```yaml -name: Security Scan -on: [push, pull_request] - -jobs: - security: - runs-on: - - ubuntu-latest - - linux_amd64 - steps: - - uses: actions/checkout@v4 - - name: Setup Trivy - uses: your-username/trivy-actions@main/setup-trivy - - name: Scan for vulnerabilities - run: trivy fs . -``` - -## Inputs - -| Input | Description | Required | Default | -| --------- | ----------------------------------------- | -------- | -------- | -| `version` | Trivy version to download (e.g., v0.66.0) | No | `latest` | diff --git a/setup-trivy/action.yaml b/setup-trivy/action.yaml deleted file mode 100644 index 393c6d3..0000000 --- a/setup-trivy/action.yaml +++ /dev/null @@ -1,68 +0,0 @@ -name: "Setup Trivy" -description: "Download and setup Trivy binary for vulnerability scanning" -author: "Gitea Actions" -branding: - icon: "shield" - color: "blue" - -inputs: - version: - description: "Trivy version to download (e.g., latest)" - required: false - default: "latest" - -runs: - using: "composite" - steps: - - shell: bash - id: arch - run: | - set -e - case "$(uname -m)" in - x86_64) - ARCH="64bit" - ;; - aarch64) - ARCH="ARM64" - ;; - esac - echo "ARCH=$ARCH" >> $GITHUB_OUTPUT - - name: Resolve version - shell: bash - id: version - run: | - set -e - if [ "${{ inputs.version }}" = "latest" ]; then - VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name') - else - VERSION="${{ inputs.version }}" - fi - echo "VERSION=$VERSION" >> $GITHUB_OUTPUT - - name: Cache Trivy binary - id: cache-trivy - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 - with: - path: /usr/local/bin/trivy - key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }} - restore-keys: | - trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }} - - name: Download and install Trivy - if: steps.cache-trivy.outputs.cache-hit != 'true' - shell: bash - run: | - set -e - - VERSION="${{ steps.version.outputs.version }}" - - mkdir -p /usr/local/bin - - curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${{ steps.arch.outputs.arch }}.tar.gz" -o trivy.tar.gz - tar -xzf trivy.tar.gz - chmod +x trivy - mv trivy /usr/local/bin/ - rm trivy.tar.gz - - - name: Add Trivy to PATH - shell: bash - run: | - echo "/usr/local/bin" >> $GITHUB_PATH