t.behrendt/sec-actions
0
0
Fork 0
Code Issues 2 Pull Requests Actions Activity

fix: ensure output dir exists
CI / Test Get Images From Files (pull_request) Successful in 4s
Details
CI / Test scan-image (pull_request) Failing after 6s
Details
CI / Test Setup DB (pull_request) Successful in 6s
Details
CI / Test scan-config (pull_request) Failing after 12s
Details
CI / Test Merge SARIF Files (pull_request) Successful in 23s
Details
CI / Test scan-fs (pull_request) Failing after 1m2s
Details

Browse Source
This commit is contained in:
Timo Behrendt
2026-04-10 19:16:33 +02:00
parent 1bd96bbcef
commit f42efd6245
7 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scan-config/README.md
+3 -3
View File
@@ -38,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
| Input | Description | Required | Default | | Input | Description | Required | Default |
| --------------- | --------------------------------------------------------------------------- | -------- | ------- | | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
| `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — |
| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | | `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` |
| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | | `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — |
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
@@ -53,5 +53,5 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
## Notes ## Notes
- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist. - **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts). **`scan-path`** must already exist.
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
scan-config/action.yaml
+4 -4
View File
@@ -10,11 +10,11 @@ inputs:
description: "Host path to the directory to scan (mounted read-only at /scan in the container)" description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
required: true required: true
cache-dir: cache-dir:
description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
required: false required: false
default: "${{ runner.temp }}/trivy" default: "${{ runner.temp }}/trivy"
output-dir: output-dir:
description: "Host directory where the report file is written (mounted read-write at /out)" description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
required: true required: true
output-file: output-file:
description: "SARIF report file name only (no slashes); written under output-dir" description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,13 +43,13 @@ runs:
run: | run: |
set -euo pipefail set -euo pipefail
case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
mkdir -p "$CACHE_DIR_IN" mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
scan_path=$(realpath "$SCAN_PATH_IN") scan_path=$(realpath "$SCAN_PATH_IN")
cache_dir=$(realpath "$CACHE_DIR_IN") cache_dir=$(realpath "$CACHE_DIR_IN")
mkdir -p "$OUTPUT_DIR_IN"
output_dir=$(realpath "$OUTPUT_DIR_IN") output_dir=$(realpath "$OUTPUT_DIR_IN")
test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; } test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
docker run --rm \ docker run --rm \
--name trivy-scan-config \ --name trivy-scan-config \
scan-fs/README.md
+3 -3
View File
@@ -38,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
| Input | Description | Required | Default | | Input | Description | Required | Default |
| --------------- | --------------------------------------------------------------------------- | -------- | ------- | | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
| `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — | | `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — |
| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | | `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` |
| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | | `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — |
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
@@ -53,6 +53,6 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
## Notes ## Notes
- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist. - **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts). **`scan-path`** must already exist.
- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**. - Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
scan-fs/action.yaml
+4 -4
View File
@@ -10,11 +10,11 @@ inputs:
description: "Host path to the directory to scan (mounted read-only at /scan in the container)" description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
required: true required: true
cache-dir: cache-dir:
description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
required: false required: false
default: "${{ runner.temp }}/trivy" default: "${{ runner.temp }}/trivy"
output-dir: output-dir:
description: "Host directory where the report file is written (mounted read-write at /out)" description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
required: true required: true
output-file: output-file:
description: "SARIF report file name only (no slashes); written under output-dir" description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,13 +43,13 @@ runs:
run: | run: |
set -euo pipefail set -euo pipefail
case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
mkdir -p "$CACHE_DIR_IN" mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
scan_path=$(realpath "$SCAN_PATH_IN") scan_path=$(realpath "$SCAN_PATH_IN")
cache_dir=$(realpath "$CACHE_DIR_IN") cache_dir=$(realpath "$CACHE_DIR_IN")
mkdir -p "$OUTPUT_DIR_IN"
output_dir=$(realpath "$OUTPUT_DIR_IN") output_dir=$(realpath "$OUTPUT_DIR_IN")
test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; } test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
docker run --rm \ docker run --rm \
--name trivy-scan-fs \ --name trivy-scan-fs \
scan-image/README.md
+3 -3
View File
@@ -37,8 +37,8 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
| Input | Description | Required | Default | | Input | Description | Required | Default |
| --------------- | --------------------------------------------------------------------------- | -------- | ------- | | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
| `image` | Image reference to scan (pulled inside the container) | Yes | — | | `image` | Image reference to scan (pulled inside the container) | Yes | — |
| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` | | `cache-dir` | Trivy cache directory (mounted read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` |
| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — | | `output-dir` | Host directory for the report (mounted read-write at `/out`; created if missing) | Yes | — |
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — | | `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` | | `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
@@ -52,6 +52,6 @@ You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Triv
## Notes ## Notes
- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist. - **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing (required for Docker bind mounts).
- Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`). - Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors). - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
scan-image/action.yaml
+4 -4
View File
@@ -10,11 +10,11 @@ inputs:
description: "Container image reference to scan (pulled by Trivy inside the container; requires network)" description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
required: true required: true
cache-dir: cache-dir:
description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)" description: "Host path to the Trivy cache directory (mounted read-only at /cache; created if missing; use the same path as setup-db)"
required: false required: false
default: "${{ runner.temp }}/trivy" default: "${{ runner.temp }}/trivy"
output-dir: output-dir:
description: "Host directory where the report file is written (mounted read-write at /out)" description: "Host directory where the report file is written (mounted read-write at /out; created if missing)"
required: true required: true
output-file: output-file:
description: "SARIF report file name only (no slashes); written under output-dir" description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,11 +43,11 @@ runs:
run: | run: |
set -euo pipefail set -euo pipefail
case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
mkdir -p "$CACHE_DIR_IN" mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
cache_dir=$(realpath "$CACHE_DIR_IN") cache_dir=$(realpath "$CACHE_DIR_IN")
mkdir -p "$OUTPUT_DIR_IN"
output_dir=$(realpath "$OUTPUT_DIR_IN") output_dir=$(realpath "$OUTPUT_DIR_IN")
test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; } test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
docker run --rm \ docker run --rm \
--name trivy-scan-image \ --name trivy-scan-image \
setup-db/README.md
+4 -4
View File
@@ -38,9 +38,9 @@ jobs:
## Inputs ## Inputs
| Input | Description | Required | Default | | Input | Description | Required | Default |
| ---------------- | --------------------------------------------------------------------------- | -------- | ------- | | --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- |
| `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` | | `cache-dir` | Path to the Trivy cache directory | No | `${{ runner.temp }}/trivy` |
| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` | | `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin. **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.