From f42efd6245ed8641f34e2d83919fe3b05d1acd14 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Fri, 10 Apr 2026 19:16:33 +0200 Subject: [PATCH] fix: ensure output dir exists --- scan-config/README.md | 6 +++--- scan-config/action.yaml | 8 ++++---- scan-fs/README.md | 6 +++--- scan-fs/action.yaml | 8 ++++---- scan-image/README.md | 6 +++--- scan-image/action.yaml | 8 ++++---- setup-db/README.md | 8 ++++---- 7 files changed, 25 insertions(+), 25 deletions(-) diff --git a/scan-config/README.md b/scan-config/README.md index a644475..7c0310d 100644 --- a/scan-config/README.md +++ b/scan-config/README.md @@ -38,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | -| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | +| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | @@ -53,5 +53,5 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca ## Notes -- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist. +- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts). **`scan-path`** must already exist. - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). diff --git a/scan-config/action.yaml b/scan-config/action.yaml index 1d95bc5..8c92fce 100644 --- a/scan-config/action.yaml +++ b/scan-config/action.yaml @@ -10,11 +10,11 @@ inputs: description: "Host path to the directory to scan (mounted read-only at /scan in the container)" required: true cache-dir: - description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" + description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)" required: false default: "${{ runner.temp }}/trivy" output-dir: - description: "Host directory where the report file is written (mounted read-write at /out)" + description: "Host directory where the report file is written (mounted read-write at /out; created if missing)" required: true output-file: description: "SARIF report file name only (no slashes); written under output-dir" @@ -43,13 +43,13 @@ runs: run: | set -euo pipefail case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac - mkdir -p "$CACHE_DIR_IN" + mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN" scan_path=$(realpath "$SCAN_PATH_IN") cache_dir=$(realpath "$CACHE_DIR_IN") - mkdir -p "$OUTPUT_DIR_IN" output_dir=$(realpath "$OUTPUT_DIR_IN") test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } + test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; } docker run --rm \ --name trivy-scan-config \ diff --git a/scan-fs/README.md b/scan-fs/README.md index cd8f644..1e29d7a 100644 --- a/scan-fs/README.md +++ b/scan-fs/README.md @@ -38,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | -| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | +| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | @@ -53,6 +53,6 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca ## Notes -- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist. +- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts). **`scan-path`** must already exist. - Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**. - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). diff --git a/scan-fs/action.yaml b/scan-fs/action.yaml index 9a9f943..08f2138 100644 --- a/scan-fs/action.yaml +++ b/scan-fs/action.yaml @@ -10,11 +10,11 @@ inputs: description: "Host path to the directory to scan (mounted read-only at /scan in the container)" required: true cache-dir: - description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" + description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)" required: false default: "${{ runner.temp }}/trivy" output-dir: - description: "Host directory where the report file is written (mounted read-write at /out)" + description: "Host directory where the report file is written (mounted read-write at /out; created if missing)" required: true output-file: description: "SARIF report file name only (no slashes); written under output-dir" @@ -43,13 +43,13 @@ runs: run: | set -euo pipefail case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac - mkdir -p "$CACHE_DIR_IN" + mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN" scan_path=$(realpath "$SCAN_PATH_IN") cache_dir=$(realpath "$CACHE_DIR_IN") - mkdir -p "$OUTPUT_DIR_IN" output_dir=$(realpath "$OUTPUT_DIR_IN") test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } + test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; } docker run --rm \ --name trivy-scan-fs \ diff --git a/scan-image/README.md b/scan-image/README.md index 43627de..409e7f5 100644 --- a/scan-image/README.md +++ b/scan-image/README.md @@ -37,8 +37,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv | Input | Description | Required | Default | | --------------- | --------------------------------------------------------------------------- | -------- | ------- | | `image` | Image reference to scan (pulled inside the container) | Yes | — | -| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | -| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | +| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` | +| `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | @@ -52,6 +52,6 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv ## Notes -- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist. +- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts). - Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`). - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). diff --git a/scan-image/action.yaml b/scan-image/action.yaml index 627764c..40dd3ec 100644 --- a/scan-image/action.yaml +++ b/scan-image/action.yaml @@ -10,11 +10,11 @@ inputs: description: "Container image reference to scan (pulled by Trivy inside the container; requires network)" required: true cache-dir: - description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" + description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)" required: false default: "${{ runner.temp }}/trivy" output-dir: - description: "Host directory where the report file is written (mounted read-write at /out)" + description: "Host directory where the report file is written (mounted read-write at /out; created if missing)" required: true output-file: description: "SARIF report file name only (no slashes); written under output-dir" @@ -43,11 +43,11 @@ runs: run: | set -euo pipefail case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac - mkdir -p "$CACHE_DIR_IN" + mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN" cache_dir=$(realpath "$CACHE_DIR_IN") - mkdir -p "$OUTPUT_DIR_IN" output_dir=$(realpath "$OUTPUT_DIR_IN") test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } + test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; } docker run --rm \ --name trivy-scan-image \ diff --git a/setup-db/README.md b/setup-db/README.md index d6028ba..60d899c 100644 --- a/setup-db/README.md +++ b/setup-db/README.md @@ -38,9 +38,9 @@ jobs: ## Inputs -| Input | Description | Required | Default | -| ---------------- | --------------------------------------------------------------------------- | -------- | ------- | -| `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` | -| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` | +| Input | Description | Required | Default | +| --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- | +| `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` | +| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` | **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.