sync

2026-03-24 21:15:45 +01:00
parent 83a7cef9f1
commit d746e98f30
15 changed files with 381 additions and 210 deletions
@@ -0,0 +1,47 @@
+# Setup OSV-Scanner Action
+
+A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning.
+
+The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`.
+
+When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub.
+
+## Usage
+
+```yaml
+- name: Setup OSV-Scanner
+  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
+  with:
+    version: "v2.3.3"
+    # Optional: override defaults when you change version
+    # sha256_linux_amd64: "..."
+    # sha256_linux_arm64: "..."
+```
+
+## Example workflow
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV-Scanner
+        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
+      - name: Scan
+        run: osv-scanner scan source -r .
+```
+
+## Inputs
+
+| Name                  | Description                                                                 | Required | Default (for `v2.3.3`) |
+| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ |
+| `version`             | Git tag of the release to install                                           | No       | `v2.3.3`                 |
+| `sha256_linux_amd64`  | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag             | No       | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` |
+| `sha256_linux_arm64`  | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag             | No       | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` |
+
+## Notes
+
+- Linux runners only (`linux_amd64` / `linux_arm64` release assets).
+- The binary is cached with `actions/cache` by version and architecture.
+- Downloads use `curl -f` so missing releases fail fast.
@@ -0,0 +1,78 @@
+name: "Setup OSV-Scanner"
+description: "Download and setup the OSV-Scanner binary for vulnerability scanning"
+author: "Gitea Actions"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs."
+    required: false
+    default: "v2.3.3"
+  sha256_linux_amd64:
+    description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version"
+    required: false
+    default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033"
+  sha256_linux_arm64:
+    description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version"
+    required: false
+    default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616"
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      id: arch
+      run: |
+        set -e
+        case "$(uname -m)" in
+          x86_64)
+            ARCH="amd64"
+            ;;
+          aarch64)
+            ARCH="arm64"
+            ;;
+          *)
+            echo "Unsupported architecture: $(uname -m)" >&2
+            exit 1
+            ;;
+        esac
+        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
+    - name: Cache OSV-Scanner binary
+      id: cache-osv
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      with:
+        path: /usr/local/bin/osv-scanner
+        key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
+        restore-keys: |
+          osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
+    - name: Download and install OSV-Scanner
+      if: steps.cache-osv.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -e
+        VERSION="${{ inputs.version }}"
+        ARCH="${{ steps.arch.outputs.arch }}"
+        case "$ARCH" in
+          amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;;
+          arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;;
+          *) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;;
+        esac
+        EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
+        mkdir -p /usr/local/bin
+        tmp="$(mktemp)"
+        trap 'rm -f "$tmp"' EXIT
+        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp"
+        ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
+        if [ "$ACTUAL" != "$EXPECTED" ]; then
+          echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2
+          exit 1
+        fi
+        mv "$tmp" /usr/local/bin/osv-scanner
+        chmod +x /usr/local/bin/osv-scanner
+
+    - name: Add OSV-Scanner to PATH
+      shell: bash
+      run: |
+        echo "/usr/local/bin" >> $GITHUB_PATH