sync

.gitea/workflows/ci.yaml

@@ -4,33 +4,35 @@ on:
   pull_request:
 
 jobs:
-  test-setup-trivy:
+  test-setup-osv-scanner:
     strategy:
       matrix:
         arch: [ amd64, arm64 ]
-    name: Test Setup Trivy ${{ matrix.arch }}
+    name: Test Setup OSV-Scanner ${{ matrix.arch }}
     runs-on:
       - ubuntu-latest
       - linux_${{ matrix.arch }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Trivy
+      - name: Setup OSV-Scanner
-        uses: ./setup-trivy
+        uses: ./setup-osv-scanner
-      - name: Run Trivy
+      - name: Run OSV-Scanner
-        run: trivy --version
+        run: osv-scanner --version
 
-  test-setup-db:
+  test-setup-osv-db:
-    name: Test Setup DB
+    name: Test Setup OSV offline DB
     runs-on:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./setup-trivy
+      - uses: ./setup-osv-scanner
-      - name: Setup DB
+      - name: Setup offline DB
         id: setup-db
-        uses: ./setup-db
+        uses: ./setup-osv-db
-      - name: Run Trivy
+      - name: Run OSV-Scanner with cached DB
-        run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
+        env:
+          OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }}
+        run: osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles -r .
 
   test-get-images-from-files:
     name: Test Get Images From Files

README.md

@@ -1,3 +1,21 @@
-# Trivy Actions
+# OSV-Scanner Actions
 
-Gitea compatible actions related to Trivy or the Trivy ecosystem.
+Gitea-compatible composite actions for [Google OSV-Scanner](https://github.com/google/osv-scanner): install the CLI, cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests.
+
+## Actions
+
+| Directory              | Purpose                                                                 |
+| ---------------------- | ----------------------------------------------------------------------- |
+| `setup-osv-scanner`    | Download and cache a pinned `osv-scanner` release (Linux amd64 / arm64), SHA256-verified. |
+| `setup-osv-db`         | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list.        |
+| `merge-sarif-files`    | Merge multiple SARIF files into one (tool-agnostic).                  |
+| `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). |
+
+## Workflows
+
+- **CI** (`.gitea/workflows/ci.yaml`): tests the actions above on `pull_request`.
+- **CD / Prerelease**: tag bump workflows unchanged (no scanner).
+
+## Documentation
+
+Each action directory has its own `README.md` with inputs, outputs, and examples.

get-images-from-files/README.md

@@ -1,6 +1,6 @@
 # Get Images From Files Action
 
-A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated.
+A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated. Use the list with `osv-scanner scan image <ref>` (or a loop in CI) to scan container images.
 
 **Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged.
 
@@ -21,7 +21,7 @@ Other files are supported if they use one of these patterns (e.g. `image:` or `F
 
 ```yaml
 - name: Get Images From Files
-  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1
   with:
     files: |
         - Dockerfile
@@ -42,7 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Get Images From Files
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1
         with:
             files: |
               - Dockerfile

merge-sarif-files/README.md

@@ -10,7 +10,7 @@ A reusable Gitea Action that merges multiple SARIF files into a single SARIF fil
 
 ```yaml
 - name: Merge SARIF Files
-  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1
   with:
     files: |
       - test_sarif1.json
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Merge SARIF Files
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1
         with:
           files: |
             - test_sarif1.json

merge-sarif-files/test_sarif1.json

@@ -5,9 +5,9 @@
     {
       "tool": {
         "driver": {
-          "fullName": "Trivy Vulnerability Scanner",
+          "fullName": "OSV-Scanner",
-          "informationUri": "https://github.com/aquasecurity/trivy",
+          "informationUri": "https://github.com/google/osv-scanner",
-          "name": "Trivy",
+          "name": "OSV-Scanner",
           "rules": [
             {
               "id": "KSV-0014",

merge-sarif-files/test_sarif2.json

@@ -5,9 +5,9 @@
     {
       "tool": {
         "driver": {
-          "fullName": "Trivy Vulnerability Scanner",
+          "fullName": "OSV-Scanner",
-          "informationUri": "https://github.com/aquasecurity/trivy",
+          "informationUri": "https://github.com/google/osv-scanner",
-          "name": "Trivy",
+          "name": "OSV-Scanner",
           "rules": [
             {
               "id": "CVE-2026-26019",

renovate.json

@@ -1,7 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>t.behrendt/renovate-configs:common",
     "local>t.behrendt/renovate-configs:action"
   ],
   "packageRules": [

setup-db/README.md

@@ -1,41 +0,0 @@
-# Setup DB Action
-
-A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
-
-**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
-
-## Usage
-
-### Basic Usage
-
-```yaml
-- name: Setup DB
-  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
-```
-
-### Complete Example
-
-```yaml
-name: Security Scan
-on: [push, pull_request]
-
-jobs:
-  security:
-    runs-on:
-      - ubuntu-latest
-      - linux_amd64
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Trivy
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
-      - name: Setup DB
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
-      - name: Scan for vulnerabilities
-        run: trivy fs .
-```
-
-## Inputs
-
-| Input       | Description                       | Required | Default          |
-| ----------- | --------------------------------- | -------- | ---------------- |
-| `cache-dir` | Path to the Trivy cache directory | No       | `~/.cache/trivy` |

setup-db/action.yaml

@@ -1,35 +0,0 @@
-name: "Setup Trivy DB"
-description: "Setup the trivy database, restoring from cache if available"
-author: "Timo Behrendt <t.behrendt@t00n.de"
-branding:
-  icon: "database"
-  color: "blue"
-
-inputs:
-  cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
-    required: false
-    default: "${{ runner.temp }}/trivy"
-
-outputs:
-  cache-dir:
-    description: "Path to the Trivy cache directory"
-    value: ${{ inputs.cache-dir }}
-
-runs:
-  using: "composite"
-  steps:
-    - id: current-date
-      shell: bash
-      run: |
-        echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
-    - id: restore-db
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-      with:
-        path: ${{ inputs.cache-dir }}
-        key: trivy-db-${{ steps.current-date.outputs.current-date }}
-        restore-keys: |
-          trivy-db-${{ steps.current-date.outputs.current-date }}
-    - if: steps.restore-db.outputs.cache-hit != 'true'
-      shell: bash
-      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"

setup-osv-db/README.md

@@ -0,0 +1,67 @@
+# Setup OSV offline DB Action
+
+A reusable Gitea Action that restores or populates the [OSV-Scanner local vulnerability cache](https://google.github.io/osv-scanner/usage/offline-mode/) used with `--offline-vulnerabilities`.
+
+Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.googleapis.com/` as described under [Manual database download](https://google.github.io/osv-scanner/usage/offline-mode/#manual-database-download): for each requested ecosystem, download `…/<ecosystem>/all.zip` into `osv-scanner/<ecosystem>/all.zip`. **OSV-Scanner is not invoked** for downloads.
+
+**Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths).
+
+**Note:** This action only prepares the local DB directory. Install the scanner separately (e.g. with the `setup-osv-scanner` action).
+
+## Ecosystems input
+
+Use **`ecosystems`**: a comma-separated list (spaces around commas are trimmed). Each token is matched to an entry from [ecosystems.txt](https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt) by:
+
+- **Slug match:** lowercased, spaces → `-`, brackets removed (e.g. `GitHub Actions` and `github-actions` both match).
+- **Special case:** `docker` is not an OSV ecosystem; it is treated as **`Linux`** (useful as a default when scanning image-related data). Override with `Alpine`, `Debian`, etc. if you prefer.
+
+The **`actions/cache` key includes** the sorted, slugified list of resolved ecosystems (e.g. `github-actions,go,linux,npm`) plus the hour bucket settings, so different ecosystem sets never share a cache entry.
+
+## Usage
+
+```yaml
+uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
+with:
+  ecosystems: PyPI,npm,Go
+```
+
+## Example workflow
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV-Scanner
+        uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-scanner@0.0.1
+      - name: Setup offline DB
+        id: setup-db
+        uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
+        with:
+          cache-bucket-hours: 6
+          ecosystems: github-actions,npm,go,Alpine
+      - name: Scan (offline vulnerabilities only)
+        env:
+          OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }}
+        run: osv-scanner scan source --offline-vulnerabilities -r .
+```
+
+## Inputs
+
+| Name                 | Description                                                                                                                                 | Required | Default                             |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------- |
+| `cache-dir`          | Directory for `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY`                                                                                        | No       | `${{ runner.temp }}/osv-scanner`   |
+| `cache-bucket-hours` | `actions/cache` primary key includes `floor(UTC unix time / (3600 × N))`.                                                                   | No       | `24`                                |
+| `ecosystems`         | Comma-separated tokens (names/slugs; `docker` → `Linux`).                                                                                     | No       | `github-actions,npm,go,docker`      |
+
+## Outputs
+
+| Name        | Description        |
+| ----------- | ------------------ |
+| `cache-dir` | Same as input path |
+
+## Behavior
+
+- **Cache:** Key pattern `osv-scanner-db-{hours}h-eco-{sorted-slugs}-{bucket}`. `restore-keys` reuse the newest cache for the same hours + ecosystem set when the current time bucket misses.
+- **Populate:** On cache miss, `${cache-dir}/osv-scanner` is recreated and only the requested ecosystems are downloaded.

setup-osv-db/action.yaml

@@ -0,0 +1,143 @@
+name: "Setup OSV offline vulnerability DB"
+description: "Populate or restore the OSV-Scanner local vulnerability database cache (offline mode)"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "database"
+  color: "blue"
+
+inputs:
+  cache-dir:
+    description: "Directory for OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{ runner.temp }}/osv-scanner)"
+    required: false
+    default: "${{ runner.temp }}/osv-scanner"
+  cache-bucket-hours:
+    description: "actions/cache key advances every this many full hours (UTC, since epoch). Example: 24 ≈ daily bucket; 1 = new key each hour."
+    required: false
+    default: "24"
+  ecosystems:
+    description: "Comma-separated ecosystem tokens (slug or official name, see README). OSV has no Docker Hub bucket; token `docker` installs the `Linux` ecosystem as a practical default for image-style data."
+    required: false
+    default: "github-actions,npm,go,docker"
+
+outputs:
+  cache-dir:
+    description: "Path passed to OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY"
+    value: ${{ inputs.cache-dir }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: prepare
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        slugify() {
+          local s="$1"
+          s=$(printf '%s' "$s" | tr '[:upper:]' '[:lower:]')
+          s=$(printf '%s' "$s" | sed 's/\[//g;s/\]//g')
+          s=$(printf '%s' "$s" | sed 's/[[:space:]]\+/-/g')
+          printf '%s' "$s"
+        }
+
+        HOURS="${{ inputs.cache-bucket-hours }}"
+        case "$HOURS" in
+          ''|*[!0-9]*) echo "cache-bucket-hours must be a positive integer, got: $HOURS" >&2; exit 1 ;;
+        esac
+        if [ "$HOURS" -lt 1 ]; then
+          echo "cache-bucket-hours must be >= 1" >&2
+          exit 1
+        fi
+        bucket=$(( $(date -u +%s) / (3600 * HOURS) ))
+        echo "hours=$HOURS" >> "$GITHUB_OUTPUT"
+        echo "bucket=$bucket" >> "$GITHUB_OUTPUT"
+
+        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
+        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
+        : > "$RESOLVED_FILE"
+
+        ecosystems_all="$(mktemp)"
+        curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt" -o "$ecosystems_all"
+
+        declare -A SLUG_TO_OFFICIAL=()
+        while IFS= read -r line || [ -n "$line" ]; do
+          line="${line//$'\r'/}"
+          [ -z "$line" ] && continue
+          slug=$(slugify "$line")
+          SLUG_TO_OFFICIAL["$slug"]="$line"
+        done < "$ecosystems_all"
+        rm -f "$ecosystems_all"
+
+        declare -A SEEN_CANONICAL=()
+        INPUT="${{ inputs.ecosystems }}"
+        INPUT="${INPUT//$'\r'/}"
+        if [ -z "${INPUT//[[:space:]]/}" ]; then
+          echo "ecosystems input is empty" >&2
+          exit 1
+        fi
+
+        IFS=',' read -ra PARTS <<< "$INPUT"
+        for raw in "${PARTS[@]}"; do
+          token=$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+          [ -z "$token" ] && continue
+          tslug=$(slugify "$token")
+          if [ "$tslug" = "docker" ]; then
+            official="Linux"
+          elif [ -n "${SLUG_TO_OFFICIAL[$tslug]+x}" ]; then
+            official="${SLUG_TO_OFFICIAL[$tslug]}"
+          else
+            echo "Unknown ecosystem token: ${token}. Valid names/slugs match https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt (token docker -> Linux)." >&2
+            exit 1
+          fi
+          if [ -z "${SEEN_CANONICAL[$official]+x}" ]; then
+            SEEN_CANONICAL[$official]=1
+            printf '%s\n' "$official" >> "$RESOLVED_FILE"
+          fi
+        done
+
+        if [ ! -s "$RESOLVED_FILE" ]; then
+          echo "No ecosystems resolved from input" >&2
+          exit 1
+        fi
+
+        slug_keys=()
+        while IFS= read -r official || [ -n "$official" ]; do
+          [ -z "$official" ] && continue
+          slug_keys+=("$(slugify "$official")")
+        done < "$RESOLVED_FILE"
+        ecosystems_key=$(printf '%s\n' "${slug_keys[@]}" | sort -u | paste -sd, -)
+        echo "ecosystems-key=$ecosystems_key" >> "$GITHUB_OUTPUT"
+    - id: restore-db
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      with:
+        path: ${{ inputs.cache-dir }}
+        key: osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-${{ steps.prepare.outputs.bucket }}
+        restore-keys: |
+          osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-
+    - if: steps.restore-db.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        CACHE_DIR="${{ inputs.cache-dir }}"
+        ROOT="${CACHE_DIR}/osv-scanner"
+        BASE="https://osv-vulnerabilities.storage.googleapis.com"
+        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
+        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
+
+        rm -rf "$ROOT"
+        mkdir -p "$ROOT"
+
+        if [ ! -s "$RESOLVED_FILE" ]; then
+          echo "Missing resolved ecosystem list at $RESOLVED_FILE" >&2
+          exit 1
+        fi
+
+        while IFS= read -r ecosystem || [ -n "$ecosystem" ]; do
+          [ -z "$ecosystem" ] && continue
+          enc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$ecosystem")"
+          dest_dir="${ROOT}/${ecosystem}"
+          mkdir -p "$dest_dir"
+          tmp="$(mktemp)"
+          curl -fsSL "${BASE}/${enc}/all.zip" -o "$tmp"
+          mv "$tmp" "${dest_dir}/all.zip"
+        done < "$RESOLVED_FILE"

setup-osv-scanner/README.md

@@ -0,0 +1,47 @@
+# Setup OSV-Scanner Action
+
+A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning.
+
+The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`.
+
+When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub.
+
+## Usage
+
+```yaml
+- name: Setup OSV-Scanner
+  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
+  with:
+    version: "v2.3.3"
+    # Optional: override defaults when you change version
+    # sha256_linux_amd64: "..."
+    # sha256_linux_arm64: "..."
+```
+
+## Example workflow
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV-Scanner
+        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
+      - name: Scan
+        run: osv-scanner scan source -r .
+```
+
+## Inputs
+
+| Name                  | Description                                                                 | Required | Default (for `v2.3.3`) |
+| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ |
+| `version`             | Git tag of the release to install                                           | No       | `v2.3.3`                 |
+| `sha256_linux_amd64`  | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag             | No       | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` |
+| `sha256_linux_arm64`  | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag             | No       | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` |
+
+## Notes
+
+- Linux runners only (`linux_amd64` / `linux_arm64` release assets).
+- The binary is cached with `actions/cache` by version and architecture.
+- Downloads use `curl -f` so missing releases fail fast.

setup-osv-scanner/action.yaml

@@ -0,0 +1,78 @@
+name: "Setup OSV-Scanner"
+description: "Download and setup the OSV-Scanner binary for vulnerability scanning"
+author: "Gitea Actions"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs."
+    required: false
+    default: "v2.3.3"
+  sha256_linux_amd64:
+    description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version"
+    required: false
+    default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033"
+  sha256_linux_arm64:
+    description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version"
+    required: false
+    default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616"
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      id: arch
+      run: |
+        set -e
+        case "$(uname -m)" in
+          x86_64)
+            ARCH="amd64"
+            ;;
+          aarch64)
+            ARCH="arm64"
+            ;;
+          *)
+            echo "Unsupported architecture: $(uname -m)" >&2
+            exit 1
+            ;;
+        esac
+        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
+    - name: Cache OSV-Scanner binary
+      id: cache-osv
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      with:
+        path: /usr/local/bin/osv-scanner
+        key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
+        restore-keys: |
+          osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
+    - name: Download and install OSV-Scanner
+      if: steps.cache-osv.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -e
+        VERSION="${{ inputs.version }}"
+        ARCH="${{ steps.arch.outputs.arch }}"
+        case "$ARCH" in
+          amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;;
+          arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;;
+          *) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;;
+        esac
+        EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
+        mkdir -p /usr/local/bin
+        tmp="$(mktemp)"
+        trap 'rm -f "$tmp"' EXIT
+        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp"
+        ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
+        if [ "$ACTUAL" != "$EXPECTED" ]; then
+          echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2
+          exit 1
+        fi
+        mv "$tmp" /usr/local/bin/osv-scanner
+        chmod +x /usr/local/bin/osv-scanner
+
+    - name: Add OSV-Scanner to PATH
+      shell: bash
+      run: |
+        echo "/usr/local/bin" >> $GITHUB_PATH

setup-trivy/README.md

@@ -1,39 +0,0 @@
-# Setup Trivy Action
-
-A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning.
-
-## Usage
-
-### Basic Usage
-
-```yaml
-- name: Setup Trivy
-  uses: your-username/trivy-actions@main/setup-trivy
-  with:
-    version: "v0.66.0" # Optional: Trivy version (default: latest)
-```
-
-### Complete Example
-
-```yaml
-name: Security Scan
-on: [push, pull_request]
-
-jobs:
-  security:
-    runs-on:
-      - ubuntu-latest
-      - linux_amd64
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Trivy
-        uses: your-username/trivy-actions@main/setup-trivy
-      - name: Scan for vulnerabilities
-        run: trivy fs .
-```
-
-## Inputs
-
-| Input     | Description                               | Required | Default  |
-| --------- | ----------------------------------------- | -------- | -------- |
-| `version` | Trivy version to download (e.g., v0.66.0) | No       | `latest` |

setup-trivy/action.yaml

@@ -1,68 +0,0 @@
-name: "Setup Trivy"
-description: "Download and setup Trivy binary for vulnerability scanning"
-author: "Gitea Actions"
-branding:
-  icon: "shield"
-  color: "blue"
-
-inputs:
-  version:
-    description: "Trivy version to download (e.g., latest)"
-    required: false
-    default: "latest"
-
-runs:
-  using: "composite"
-  steps:
-    - shell: bash
-      id: arch
-      run: |
-        set -e
-        case "$(uname -m)" in
-          x86_64)
-            ARCH="64bit"
-            ;;
-          aarch64)
-            ARCH="ARM64"
-            ;;
-        esac
-        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
-    - name: Resolve version
-      shell: bash
-      id: version
-      run: |
-        set -e
-        if [ "${{ inputs.version }}" = "latest" ]; then
-          VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name')
-        else
-          VERSION="${{ inputs.version }}"
-        fi
-        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
-    - name: Cache Trivy binary
-      id: cache-trivy
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-      with:
-        path: /usr/local/bin/trivy
-        key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
-        restore-keys: |
-          trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
-    - name: Download and install Trivy
-      if: steps.cache-trivy.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        set -e
-
-        VERSION="${{ steps.version.outputs.version }}"
-
-        mkdir -p /usr/local/bin
-
-        curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${{ steps.arch.outputs.arch }}.tar.gz" -o trivy.tar.gz
-        tar -xzf trivy.tar.gz
-        chmod +x trivy
-        mv trivy /usr/local/bin/
-        rm trivy.tar.gz
-
-    - name: Add Trivy to PATH
-      shell: bash
-      run: |
-        echo "/usr/local/bin" >> $GITHUB_PATH