sync

2026-03-24 21:15:45 +01:00
parent 83a7cef9f1
commit d746e98f30
15 changed files with 381 additions and 210 deletions
@@ -0,0 +1,47 @@
+# Setup OSV-Scanner Action
+
+A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning.
+
+The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`.
+
+When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub.
+
+## Usage
+
+```yaml
+- name: Setup OSV-Scanner
+  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
+  with:
+    version: "v2.3.3"
+    # Optional: override defaults when you change version
+    # sha256_linux_amd64: "..."
+    # sha256_linux_arm64: "..."
+```
+
+## Example workflow
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV-Scanner
+        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
+      - name: Scan
+        run: osv-scanner scan source -r .
+```
+
+## Inputs
+
+| Name                  | Description                                                                 | Required | Default (for `v2.3.3`) |
+| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ |
+| `version`             | Git tag of the release to install                                           | No       | `v2.3.3`                 |
+| `sha256_linux_amd64`  | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag             | No       | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` |
+| `sha256_linux_arm64`  | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag             | No       | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` |
+
+## Notes
+
+- Linux runners only (`linux_amd64` / `linux_arm64` release assets).
+- The binary is cached with `actions/cache` by version and architecture.
+- Downloads use `curl -f` so missing releases fail fast.