fix: ensure output dir exists

2026-04-10 19:16:33 +02:00
parent 1bd96bbcef
commit f42efd6245
7 changed files with 25 additions and 25 deletions
@@ -38,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

@@ -53,5 +53,5 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca

 ## Notes

- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts). **`scan-path`** must already exist.
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).