refactor!: trivy to osv

setup-osv/README.md

@@ -0,0 +1,51 @@
+# Setup OSV Scanner Action
+
+A reusable Gitea Action that downloads and sets up the osv-scanner binary for vulnerability scanning.
+
+The downloaded binary is verified against a pinned SHA-256 digest for the runner architecture.
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup OSV Scanner
+  uses: your-username/osv-scanner-actions@main/setup-osv
+  with:
+    version: "v2.4.0"
+    amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+    arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
+```
+
+Digests are published in each release's `osv-scanner_SHA256SUMS` file (e.g. for `osv-scanner_linux_amd64` / `osv-scanner_linux_arm64`). You may pass either bare hex or `sha256:<hex>`.
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV Scanner
+        uses: your-username/osv-scanner-actions@main/setup-osv
+        with:
+          version: "v2.4.0"
+          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
+      - name: Scan for vulnerabilities
+        run: osv-scanner scan source -r .
+```
+
+## Inputs
+
+| Input          | Description                                                          | Required | Default |
+| -------------- | -------------------------------------------------------------------- | -------- | ------- |
+| `version`      | Explicit osv-scanner release tag (e.g. `v2.4.0`). `latest` is rejected | Yes      | —       |
+| `amd64-digest` | SHA-256 of `osv-scanner_linux_amd64` (hex or `sha256:<hex>`)         | Yes      | —       |
+| `arm64-digest` | SHA-256 of `osv-scanner_linux_arm64` (hex or `sha256:<hex>`)         | Yes      | —       |