run on experimental dind runner

.gitea/workflows/ci.yaml

@@ -8,6 +8,7 @@ jobs:
     name: Test Setup DB
     runs-on:
       - ubuntu-latest
+      - experimental
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup DB

scan-config/README.md

@@ -6,8 +6,6 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
 
-**Docker-in-Docker:** **`cache-dir`** and **`output-dir`** default under **`runner.temp`** so bind mounts work when the job runs in a container with DinD. **`scan-path`** must also be on the same shared volume the Docker daemon uses (often under your runner’s work/temp tree); see [setup-db](../setup-db) README.
-
 ## Prerequisites
 
 - Docker on the runner.
@@ -25,7 +23,6 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
   uses: ./scan-config
   with:
     scan-path: ${{ github.workspace }}
-    # On DinD, if bind mounts fail, use a path under ${{ runner.temp }} (or your runner’s shared work dir) instead.
     cache-dir: ${{ steps.db.outputs.cache-dir }}
     output-dir: ${{ runner.temp }}/trivy-reports
     output-file: misconfig.sarif
@@ -41,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (read-only at `/cache`; created if missing)            | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Report directory (read-write at `/out`; created if missing)                 | Yes      | —       |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
 
@@ -56,5 +53,5 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 ## Notes
 
-- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing. **`scan-path`** must already exist and be bind-mountable (see DinD note above).
+- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
 - The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-config/action.yaml

@@ -10,11 +10,11 @@ inputs:
     description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
     required: true
   cache-dir:
-    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
     default: "${{ runner.temp }}/trivy"
   output-dir:
-    description: "Report directory (bind-mounted read-write at /out; created if missing)"
+    description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
   output-file:
     description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,13 +43,12 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
         scan_path=$(realpath "$SCAN_PATH_IN")
         cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
         test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
         test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
-        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
 
         docker run --rm \
           --name trivy-scan-config \

scan-fs/README.md

@@ -6,8 +6,6 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 
 **Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
 
-**Docker-in-Docker:** Same bind-mount rules as [scan-config](../scan-config): prefer **`runner.temp`** (defaults) and a **`scan-path`** on the volume shared with DinD—see [setup-db](../setup-db) README.
-
 ## Prerequisites
 
 - Docker on the runner.
@@ -40,8 +38,8 @@ The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/sca
 | Input           | Description                                                                 | Required | Default |
 | --------------- | --------------------------------------------------------------------------- | -------- | ------- |
 | `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (read-only at `/cache`; created if missing)            | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Report directory (read-write at `/out`; created if missing)                 | Yes      | —       |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
 | `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
 | `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
 

scan-fs/action.yaml

@@ -10,11 +10,11 @@ inputs:
     description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
     required: true
   cache-dir:
-    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
     default: "${{ runner.temp }}/trivy"
   output-dir:
-    description: "Report directory (bind-mounted read-write at /out; created if missing)"
+    description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
   output-file:
     description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,13 +43,12 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
         scan_path=$(realpath "$SCAN_PATH_IN")
         cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
         test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
         test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
-        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
 
         docker run --rm \
           --name trivy-scan-fs \

scan-image/action.yaml

@@ -10,11 +10,11 @@ inputs:
     description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
     required: true
   cache-dir:
-    description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
     required: false
     default: "${{ runner.temp }}/trivy"
   output-dir:
-    description: "Report directory (bind-mounted read-write at /out; created if missing)"
+    description: "Host directory where the report file is written (mounted read-write at /out)"
     required: true
   output-file:
     description: "SARIF report file name only (no slashes); written under output-dir"
@@ -43,11 +43,10 @@ runs:
       run: |
         set -euo pipefail
         case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
         cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
         output_dir=$(realpath "$OUTPUT_DIR_IN")
         test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
-        test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
 
         docker run --rm \
           --name trivy-scan-image \

setup-db/README.md

@@ -4,8 +4,6 @@ A reusable Gitea Action that sets up the Trivy vulnerability database, restoring
 
 The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
 
-**Docker-in-Docker:** If the job runs **in a container** and talks to a **DinD sidecar**, bind-mount sources must live on the volume **both** the job and the Docker daemon see. On GitHub-hosted-style setups that is typically under **`RUNNER_TEMP`** (e.g. `/home/runner/_work/_temp`). The default **`cache-dir`** is **`${{ runner.temp }}/trivy`** for that reason—see [this overview of DinD bind mounts](https://dev.to/devactivity/navigating-github-actions-dind-bind-mounts-insights-from-recent-github-reports-for-cicd-1c8). Configure your Gitea runner the same way, or set **`cache-dir`** to a path your platform documents as shared with DinD.
-
 **Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
 
 ## Usage
@@ -42,7 +40,7 @@ jobs:
 
 | Input            | Description                                                                 | Required | Default |
 | ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
-| `cache-dir`      | Trivy cache directory (created if missing; bind-mounted for DB download)     | No       | `${{ runner.temp }}/trivy` |
+| `cache-dir`      | Path to the Trivy cache directory                                           | No       | `${{ runner.temp }}/trivy` |
 | `trivy-version`  | Docker image reference for Trivy (digest pin recommended)                   | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
 
 **`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.

setup-db/action.yaml

@@ -7,7 +7,7 @@ branding:
 
 inputs:
   cache-dir:
-    description: "Trivy cache directory on the job filesystem (default under runner.temp—shared with Docker-in-Docker sidecars; bind-mounted into the Trivy container)"
+    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
     required: false
     default: "${{ runner.temp }}/trivy"
   trivy-version:
@@ -27,9 +27,6 @@ runs:
       shell: bash
       run: |
         echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
-    - name: Ensure Trivy cache directory exists
-      shell: bash
-      run: mkdir -p "${{ inputs.cache-dir }}"
     - id: restore-db
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
       with:
@@ -56,4 +53,4 @@ runs:
           --security-opt apparmor=docker-default \
           --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
           --mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
-          ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache --offline-scan --exit-code 0
+          ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache