try again

feat: add safely wrapped scan-* workflows
adjust tests
2026-04-10 19:30:52 +02:00 · 2026-04-10 19:05:43 +02:00 · 2026-04-10 18:43:14 +02:00 · 2026-04-10 18:43:14 +02:00
14 changed files with 592 additions and 143 deletions
@@ -10,15 +10,15 @@ jobs:
    name: Release
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Increment tag
        id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@b8806ee0141a44be30e8734dff15001361be100c # 0.1.35
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
        with:
          token: ${{ secrets.GITEA_TOKEN }}
      - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
        with:
          tag: ${{ steps.tag.outputs.new-tag }}
@@ -4,40 +4,124 @@ on:
  pull_request:

 jobs:
-  test-setup-trivy:
-    strategy:
-      matrix:
-        arch: [amd64, arm64]
-    name: Test Setup Trivy ${{ matrix.arch }}
-    runs-on:
-      - ubuntu-latest
-      - linux_${{ matrix.arch }}
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - name: Setup Trivy
-        uses: ./setup-trivy
-      - name: Run Trivy
-        run: trivy --version
-
  test-setup-db:
    name: Test Setup DB
    runs-on:
      - ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./setup-trivy
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup DB
        id: setup-db
        uses: ./setup-db
-      - name: Run Trivy
-        run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
+      - name: Verify vulnerability DB in cache
+        run: |
+          set -euo pipefail
+          cache="${{ steps.setup-db.outputs.cache-dir }}"
+          db="$cache/db/trivy.db"
+          meta="$cache/db/metadata.json"
+          test -f "$meta" || { echo "FAIL: $meta missing (DB not downloaded?)"; exit 1; }
+          test -f "$db" || { echo "FAIL: $db missing (DB not downloaded?)"; exit 1; }
+          size=$(stat -c%s "$db")
+          min=$((3 * 1024 * 1024))
+          if [ "$size" -lt "$min" ]; then
+            echo "FAIL: trivy.db too small ($size bytes; expected at least $min bytes, i.e. a few MiB)"
+            exit 1
+          fi
+          echo "OK: trivy.db is present ($size bytes) and metadata.json exists."
+
+  test-scan-config:
+    name: Test scan-config
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Trivy DB cache
+        id: db
+        uses: ./setup-db
+      - name: Create ephemeral config fixture
+        id: fixture
+        run: |
+          set -euo pipefail
+          scan="${{ runner.temp }}/trivy-ci-scan-config"
+          reports="${{ runner.temp }}/trivy-ci-reports-config"
+          mkdir -p "$scan" "$reports"
+          printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
+          echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
+          echo "reports=$reports" >> "$GITHUB_OUTPUT"
+      - name: Run scan-config
+        id: scan
+        uses: ./scan-config
+        with:
+          scan-path: ${{ steps.fixture.outputs.scan-path }}
+          cache-dir: ${{ steps.db.outputs.cache-dir }}
+          output-dir: ${{ steps.fixture.outputs.reports }}
+          output-file: report.sarif
+      - name: Check output file exists
+        run: test -f "${{ steps.scan.outputs.output-path }}"
+
+  test-scan-fs:
+    name: Test scan-fs
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Trivy DB cache
+        id: db
+        uses: ./setup-db
+      - name: Create ephemeral filesystem fixture
+        id: fixture
+        run: |
+          set -euo pipefail
+          scan="${{ runner.temp }}/trivy-ci-scan-fs"
+          reports="${{ runner.temp }}/trivy-ci-reports-fs"
+          mkdir -p "$scan" "$reports"
+          printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
+          echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
+          echo "reports=$reports" >> "$GITHUB_OUTPUT"
+      - name: Run scan-fs
+        id: scan
+        uses: ./scan-fs
+        with:
+          scan-path: ${{ steps.fixture.outputs.scan-path }}
+          cache-dir: ${{ steps.db.outputs.cache-dir }}
+          output-dir: ${{ steps.fixture.outputs.reports }}
+          output-file: report.sarif
+      - name: Check output file exists
+        run: test -f "${{ steps.scan.outputs.output-path }}"
+
+  test-scan-image:
+    name: Test scan-image
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Trivy DB cache
+        id: db
+        uses: ./setup-db
+      - name: Prepare report directory
+        id: fixture
+        run: |
+          set -euo pipefail
+          reports="${{ runner.temp }}/trivy-ci-reports-image"
+          mkdir -p "$reports"
+          echo "reports=$reports" >> "$GITHUB_OUTPUT"
+      - name: Run scan-image
+        id: scan
+        uses: ./scan-image
+        with:
+          image: ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c
+          cache-dir: ${{ steps.db.outputs.cache-dir }}
+          output-dir: ${{ steps.fixture.outputs.reports }}
+          output-file: report.sarif
+      - name: Check output file exists
+        run: test -f "${{ steps.scan.outputs.output-path }}"

  test-get-images-from-files:
    name: Test Get Images From Files
    runs-on:
      - ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - id: giff
        uses: ./get-images-from-files
        with:
@@ -88,7 +172,7 @@ jobs:
    runs-on:
      - ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Merge SARIF Files
        uses: ./merge-sarif-files
        with:
@@ -8,16 +8,16 @@ jobs:
    name: Prerelease
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Increment tag
        id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@b8806ee0141a44be30e8734dff15001361be100c # 0.1.35
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          prerelease: true
      - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@38c1bbd8bad3e7965744d03de85faa4a5b808d1b # 0.2.4
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
        with:
          tag: ${{ steps.tag.outputs.new-tag }}
@@ -1,5 +1,26 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["local>t.behrendt/renovate-configs:action"],
-  "enabledManagers": "github-actions"
+  "extends": [
+    "local>t.behrendt/renovate-configs:common",
+    "local>t.behrendt/renovate-configs:action"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Update Trivy docker image",
+      "managerFilePatterns": [
+        "/(^|/)(setup-db|scan-config|scan-fs|scan-image)/action\\.ya?ml$/"
+      ],
+      "datasourceTemplate": "docker",
+      "matchStrings": [
+        "default:\\s*\"(?<depName>ghcr\\.io/aquasecurity/trivy):(?<currentValue>[\\d\\.]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\""
+      ]
+    }
+  ],
+  "packageRules": [
+    {
+      "matchManagers": ["dockerfile", "kubernetes", "helmfile", "helm-values"],
+      "ignorePaths": ["get-images-from-files/test*"]
+    }
+  ]
 }
@@ -0,0 +1,60 @@
+# Trivy scan (misconfiguration)
+
+Composite action that runs **`trivy config`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The vulnerability and policy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to resolve dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
+
+**Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
+
+**Docker-in-Docker:** **`cache-dir`** and **`output-dir`** default under **`runner.temp`** so bind mounts work when the job runs in a container with DinD. **`scan-path`** must also be on the same shared volume the Docker daemon uses (often under your runner’s work/temp tree); see [setup-db](../setup-db) README.
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- uses: actions/checkout@v4
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Misconfiguration scan
+  id: scan
+  uses: ./scan-config
+  with:
+    scan-path: ${{ github.workspace }}
+    # On DinD, if bind mounts fail, use a path under ${{ runner.temp }} (or your runner’s shared work dir) instead.
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: misconfig.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-misconfig
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (read-only at `/cache`; created if missing)            | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Report directory (read-write at `/out`; created if missing)                 | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing. **`scan-path`** must already exist and be bind-mountable (see DinD note above).
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
@@ -0,0 +1,82 @@
+name: "Trivy scan (misconfiguration)"
+description: "Run trivy config in a locked-down Docker container (misconfiguration / IaC); report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  scan-path:
+    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
+    required: true
+  cache-dir:
+    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Report directory (bind-mounted read-write at /out; created if missing)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        SCAN_PATH_IN: ${{ inputs.scan-path }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
+        scan_path=$(realpath "$SCAN_PATH_IN")
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-config \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --network none \
+          --mount type=bind,src="$scan_path",dst=/scan,ro \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          config /scan \
+          --cache-dir /cache \
+          --skip-check-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
@@ -0,0 +1,60 @@
+# Trivy scan (filesystem)
+
+Composite action that runs **`trivy filesystem`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
+
+**Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
+
+**Docker-in-Docker:** Same bind-mount rules as [scan-config](../scan-config): prefer **`runner.temp`** (defaults) and a **`scan-path`** on the volume shared with DinD—see [setup-db](../setup-db) README.
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- uses: actions/checkout@v4
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Filesystem scan
+  id: scan
+  uses: ./scan-fs
+  with:
+    scan-path: ${{ github.workspace }}
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: fs.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-fs
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (read-only at `/cache`; created if missing)            | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Report directory (read-write at `/out`; created if missing)                 | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
@@ -0,0 +1,83 @@
+name: "Trivy scan (filesystem)"
+description: "Run trivy filesystem in a locked-down Docker container; report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "search"
+  color: "blue"
+
+inputs:
+  scan-path:
+    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
+    required: true
+  cache-dir:
+    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Report directory (bind-mounted read-write at /out; created if missing)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        SCAN_PATH_IN: ${{ inputs.scan-path }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
+        scan_path=$(realpath "$SCAN_PATH_IN")
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-fs \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --network none \
+          --mount type=bind,src="$scan_path",dst=/scan,ro \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          filesystem /scan \
+          --cache-dir /cache \
+          --skip-db-update \
+          --skip-check-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
@@ -0,0 +1,57 @@
+# Trivy scan (image)
+
+Composite action that runs **`trivy image`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Trivy pulls and scans it inside the container. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache` (**`--skip-db-update`** avoids re-downloading the DB). Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present). Image layers are still pulled over the network when needed.
+
+**Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)).
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Image scan
+  id: scan
+  uses: ./scan-image
+  with:
+    image: alpine:3.20
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: image.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-image
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
+- Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
@@ -0,0 +1,78 @@
+name: "Trivy scan (image)"
+description: "Run trivy image in a locked-down Docker container; report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "package"
+  color: "blue"
+
+inputs:
+  image:
+    description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
+    required: true
+  cache-dir:
+    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Report directory (bind-mounted read-write at /out; created if missing)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        IMAGE_REF: ${{ inputs.image }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-image \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          image "$IMAGE_REF" \
+          --cache-dir /cache \
+          --skip-db-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
@@ -2,7 +2,11 @@

 A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.

-**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
+The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
+
+**Docker-in-Docker:** If the job runs **in a container** and talks to a **DinD sidecar**, bind-mount sources must live on the volume **both** the job and the Docker daemon see. On GitHub-hosted-style setups that is typically under **`RUNNER_TEMP`** (e.g. `/home/runner/_work/_temp`). The default **`cache-dir`** is **`${{ runner.temp }}/trivy`** for that reason—see [this overview of DinD bind mounts](https://dev.to/devactivity/navigating-github-actions-dind-bind-mounts-insights-from-recent-github-reports-for-cicd-1c8). Configure your Gitea runner the same way, or set **`cache-dir`** to a path your platform documents as shared with DinD.
+
+**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).

 ## Usage

@@ -36,6 +40,9 @@ jobs:

 ## Inputs

-| Input       | Description                       | Required | Default          |
-| ----------- | --------------------------------- | -------- | ---------------- |
-| `cache-dir` | Path to the Trivy cache directory | No       | `~/.cache/trivy` |
+| Input            | Description                                                                 | Required | Default |
+| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `cache-dir`      | Trivy cache directory (created if missing; bind-mounted for DB download)     | No       | `${{ runner.temp }}/trivy` |
+| `trivy-version`  | Docker image reference for Trivy (digest pin recommended)                   | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
+
+**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.
@@ -7,9 +7,13 @@ branding:

 inputs:
  cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Trivy cache directory on the job filesystem (default under runner.temp—shared with Docker-in-Docker sidecars; bind-mounted into the Trivy container)"
    required: false
    default: "${{ runner.temp }}/trivy"
+  trivy-version:
+    description: "Trivy docker image version to use (full image reference including digest is recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"

 outputs:
  cache-dir:
@@ -23,8 +27,11 @@ runs:
      shell: bash
      run: |
        echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
+    - name: Ensure Trivy cache directory exists
+      shell: bash
+      run: mkdir -p "${{ inputs.cache-dir }}"
    - id: restore-db
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
      with:
        path: ${{ inputs.cache-dir }}
        key: trivy-db-${{ steps.current-date.outputs.current-date }}
@@ -32,4 +39,21 @@ runs:
          trivy-db-${{ steps.current-date.outputs.current-date }}
    - if: steps.restore-db.outputs.cache-hit != 'true'
      shell: bash
-      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"
+      run: |
+        docker run --rm \
+          --name trivy-db-download \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
+          ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache --offline-scan --exit-code 0
@@ -1,39 +0,0 @@
-# Setup Trivy Action
-
-A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning.
-
-## Usage
-
-### Basic Usage
-
-```yaml
- name: Setup Trivy
-  uses: your-username/trivy-actions@main/setup-trivy
-  with:
-    version: "v0.66.0" # Optional: Trivy version (default: latest)
-```
-
-### Complete Example
-
-```yaml
-name: Security Scan
-on: [push, pull_request]
-
-jobs:
-  security:
-    runs-on:
-      - ubuntu-latest
-      - linux_amd64
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Trivy
-        uses: your-username/trivy-actions@main/setup-trivy
-      - name: Scan for vulnerabilities
-        run: trivy fs .
-```
-
-## Inputs
-
-| Input     | Description                               | Required | Default  |
-| --------- | ----------------------------------------- | -------- | -------- |
-| `version` | Trivy version to download (e.g., v0.66.0) | No       | `latest` |
@@ -1,68 +0,0 @@
-name: "Setup Trivy"
-description: "Download and setup Trivy binary for vulnerability scanning"
-author: "Gitea Actions"
-branding:
-  icon: "shield"
-  color: "blue"
-
-inputs:
-  version:
-    description: "Trivy version to download (e.g., latest)"
-    required: false
-    default: "latest"
-
-runs:
-  using: "composite"
-  steps:
-    - shell: bash
-      id: arch
-      run: |
-        set -e
-        case "$(uname -m)" in
-          x86_64)
-            ARCH="64bit"
-            ;;
-          aarch64)
-            ARCH="ARM64"
-            ;;
-        esac
-        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
-    - name: Resolve version
-      shell: bash
-      id: version
-      run: |
-        set -e
-        if [ "${{ inputs.version }}" = "latest" ]; then
-          VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name')
-        else
-          VERSION="${{ inputs.version }}"
-        fi
-        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
-    - name: Cache Trivy binary
-      id: cache-trivy
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: /usr/local/bin/trivy
-        key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
-        restore-keys: |
-          trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
-    - name: Download and install Trivy
-      if: steps.cache-trivy.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        set -e
-
-        VERSION="${{ steps.version.outputs.version }}"
-
-        mkdir -p /usr/local/bin
-
-        curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${{ steps.arch.outputs.arch }}.tar.gz" -o trivy.tar.gz
-        tar -xzf trivy.tar.gz
-        chmod +x trivy
-        mv trivy /usr/local/bin/
-        rm trivy.tar.gz
-
-    - name: Add Trivy to PATH
-      shell: bash
-      run: |
-        echo "/usr/local/bin" >> $GITHUB_PATH
Author	SHA1	Message	Date
t.behrendt	954681c5af	try again CI / Test Merge SARIF Files (pull_request) Successful in 4s Details CI / Test Setup DB (pull_request) Successful in 6s Details CI / Test Get Images From Files (pull_request) Successful in 5s Details CI / Test scan-image (pull_request) Failing after 6s Details CI / Test scan-fs (pull_request) Failing after 1m14s Details CI / Test scan-config (pull_request) Failing after 1m2s Details	2026-04-10 19:30:52 +02:00
t.behrendt	6e5f62d4dd	feat: add safely wrapped scan-* workflows CI / Test Merge SARIF Files (pull_request) Successful in 4s Details CI / Test scan-config (pull_request) Failing after 7s Details CI / Test scan-image (pull_request) Failing after 6s Details CI / Test Setup DB (pull_request) Successful in 12s Details CI / Test Get Images From Files (pull_request) Successful in 14s Details CI / Test scan-fs (pull_request) Failing after 1m2s Details	2026-04-10 19:05:43 +02:00
t.behrendt	3d3c7b3265	adjust tests CI / Test Setup DB (pull_request) Successful in 5s Details CI / Test Merge SARIF Files (pull_request) Successful in 10s Details CI / Test Get Images From Files (pull_request) Successful in 14s Details	2026-04-10 18:43:14 +02:00
t.behrendt	c1144841b1	chore: remove setup-trivy action	2026-04-10 18:43:14 +02:00