fix: ensure output dir exists

scan-image/README.md

@@ -37,8 +37,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
 
@@ -52,6 +52,6 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 
 ## Notes
 
-- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
+- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts).
 - Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-image/action.yaml

@@ -10,11 +10,11 @@ inputs:
     description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
     required: true
   cache-dir:
-    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
     required: false
     default: "${{ runner.temp }}/trivy"
   output-dir:
-    description: "Host directory where the report file is written (mounted read-write at /out)"
+    description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
     required: true
   output-file:
     description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,11 +43,11 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        mkdir -p "$CACHE_DIR_IN"
+        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
-        mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
         test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
 
         docker run --rm \
           --name trivy-scan-image \