fix: ensure output dir exists

2026-04-10 19:16:33 +02:00
parent 1bd96bbcef
commit f42efd6245
7 changed files with 25 additions and 25 deletions
@@ -37,8 +37,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`; created if missing)   | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

@@ -52,6 +52,6 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv

 ## Notes

- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
+- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts).
 - Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).