refactor!: trivy to osv

2026-07-18 06:55:58 +02:00
parent 1e5381502a
commit fc021d4bd9
8 changed files with 269 additions and 138 deletions
@@ -0,0 +1,104 @@
+name: "Setup OSV Scanner"
+description: "Download and setup osv-scanner binary for vulnerability scanning"
+author: "Gitea Actions"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "osv-scanner version to download (e.g., v2.4.0). Must be an explicit release tag; 'latest' is not allowed."
+    required: true
+  amd64-digest:
+    description: "SHA-256 digest of the linux amd64 binary (hex or sha256:<hex>)"
+    required: true
+  arm64-digest:
+    description: "SHA-256 digest of the linux arm64 binary (hex or sha256:<hex>)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Resolve architecture and digest
+      shell: bash
+      id: arch
+      run: |
+        set -euo pipefail
+
+        VERSION="${{ inputs.version }}"
+        if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then
+          echo "version must be an explicit release tag (e.g. v2.4.0); 'latest' is not allowed" >&2
+          exit 1
+        fi
+
+        case "$(uname -m)" in
+          x86_64)
+            ARCH="amd64"
+            DIGEST="${{ inputs.amd64-digest }}"
+            ;;
+          aarch64)
+            ARCH="arm64"
+            DIGEST="${{ inputs.arm64-digest }}"
+            ;;
+          *)
+            echo "Unsupported architecture: $(uname -m)" >&2
+            exit 1
+            ;;
+        esac
+
+        if [ -z "${DIGEST}" ]; then
+          echo "Missing digest for architecture ${ARCH}" >&2
+          exit 1
+        fi
+
+        # Normalize sha256:<hex> / SHA256:<hex> to bare hex
+        DIGEST="${DIGEST#sha256:}"
+        DIGEST="${DIGEST#SHA256:}"
+
+        if ! [[ "${DIGEST}" =~ ^[a-fA-F0-9]{64}$ ]]; then
+          echo "Invalid ${ARCH} digest (expected 64-char hex or sha256:<hex>): ${DIGEST}" >&2
+          exit 1
+        fi
+
+        echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
+        echo "DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT"
+        echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+    - name: Cache osv-scanner binary
+      id: cache-osv
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: /usr/local/bin/osv-scanner
+        key: osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
+        restore-keys: |
+          osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
+    - name: Download and install osv-scanner
+      if: steps.cache-osv.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        VERSION="${{ steps.arch.outputs.version }}"
+        ARCH="${{ steps.arch.outputs.arch }}"
+        EXPECTED_DIGEST="${{ steps.arch.outputs.digest }}"
+        DEST="/usr/local/bin/osv-scanner"
+
+        mkdir -p /usr/local/bin
+
+        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "${DEST}"
+
+        ACTUAL_DIGEST=$(sha256sum "${DEST}" | awk '{print $1}')
+        if [ "${ACTUAL_DIGEST}" != "${EXPECTED_DIGEST}" ]; then
+          echo "Digest mismatch for osv-scanner ${VERSION} (linux_${ARCH})" >&2
+          echo "  expected: ${EXPECTED_DIGEST}" >&2
+          echo "  actual:   ${ACTUAL_DIGEST}" >&2
+          rm -f "${DEST}"
+          exit 1
+        fi
+
+        chmod +x "${DEST}"
+        echo "Verified osv-scanner ${VERSION} (linux_${ARCH}) digest ${ACTUAL_DIGEST}"
+
+    - name: Add osv-scanner to PATH
+      shell: bash
+      run: |
+        echo "/usr/local/bin" >> "$GITHUB_PATH"