refactor!: trivy to osv

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment) | action | patch | `0.1.35` → `0.1.39` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/10) for more information.

---

### Release Notes

<details>
<summary>t.behrendt/conventional-semantic-git-tag-increment (https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment)</summary>

### [`v0.1.39`](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.38...0.1.39)

[Compare Source](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.38...0.1.39)

### [`v0.1.38`](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.37...0.1.38)

[Compare Source](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.37...0.1.38)

### [`v0.1.37`](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.36...0.1.37)

[Compare Source](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.36...0.1.37)

### [`v0.1.36`](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.35...0.1.36)

[Compare Source](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.35...0.1.36)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My4yMzMuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYWN0aW9uIiwiYXV0b21lcmdlIiwiZGVwcyJdfQ==-->

Reviewed-on: #60
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>

.gitea/workflows/cd.yaml

@@ -10,15 +10,15 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@e393dbb067c09fd43519392572ccf63b66cba92d # 0.1.39
         with:
           token: ${{ secrets.GITEA_TOKEN }}
       - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@0841ccc70fc2c1526123785f3b0a510a6ba4bdfc # 0.2.7
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -4,125 +4,52 @@ on:
   pull_request:
 
 jobs:
+  test-setup-osv:
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+    name: Test Setup OSV Scanner ${{ matrix.arch }}
+    runs-on:
+      - ubuntu-latest
+      - linux_${{ matrix.arch }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Setup OSV Scanner
+        uses: ./setup-osv
+        with:
+          version: v2.4.0
+          amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
+          arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
+      - name: Run osv-scanner
+        run: osv-scanner --version
+
   test-setup-db:
     name: Test Setup DB
     runs-on:
       - ubuntu-latest
-      - experimental
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Setup DB
         id: setup-db
         uses: ./setup-db
-      - name: Verify vulnerability DB in cache
-        run: |
-          set -euo pipefail
-          cache="${{ steps.setup-db.outputs.cache-dir }}"
-          db="$cache/db/trivy.db"
-          meta="$cache/db/metadata.json"
-          test -f "$meta" || { echo "FAIL: $meta missing (DB not downloaded?)"; exit 1; }
-          test -f "$db" || { echo "FAIL: $db missing (DB not downloaded?)"; exit 1; }
-          size=$(stat -c%s "$db")
-          min=$((3 * 1024 * 1024))
-          if [ "$size" -lt "$min" ]; then
-            echo "FAIL: trivy.db too small ($size bytes; expected at least $min bytes, i.e. a few MiB)"
-            exit 1
-          fi
-          echo "OK: trivy.db is present ($size bytes) and metadata.json exists."
-
-  test-scan-config:
-    name: Test scan-config
-    runs-on:
-      - ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Trivy DB cache
-        id: db
-        uses: ./setup-db
-      - name: Create ephemeral config fixture
-        id: fixture
-        run: |
-          set -euo pipefail
-          scan="${{ runner.temp }}/trivy-ci-scan-config"
-          reports="${{ runner.temp }}/trivy-ci-reports-config"
-          mkdir -p "$scan" "$reports"
-          printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
-          echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
-          echo "reports=$reports" >> "$GITHUB_OUTPUT"
-      - name: Run scan-config
-        id: scan
-        uses: ./scan-config
         with:
-          scan-path: ${{ steps.fixture.outputs.scan-path }}
-          cache-dir: ${{ steps.db.outputs.cache-dir }}
-          output-dir: ${{ steps.fixture.outputs.reports }}
-          output-file: report.sarif
-      - name: Check output file exists
-        run: test -f "${{ steps.scan.outputs.output-path }}"
-
-  test-scan-fs:
-    name: Test scan-fs
-    runs-on:
-      - ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Trivy DB cache
-        id: db
-        uses: ./setup-db
-      - name: Create ephemeral filesystem fixture
-        id: fixture
+          # Keep CI fast; full ecosystem download is covered by the action default.
+          ecosystems: Go,npm,PyPI
+      - name: Run osv-scanner offline
         run: |
-          set -euo pipefail
-          scan="${{ runner.temp }}/trivy-ci-scan-fs"
-          reports="${{ runner.temp }}/trivy-ci-reports-fs"
-          mkdir -p "$scan" "$reports"
-          printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
-          echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
-          echo "reports=$reports" >> "$GITHUB_OUTPUT"
-      - name: Run scan-fs
-        id: scan
-        uses: ./scan-fs
-        with:
-          scan-path: ${{ steps.fixture.outputs.scan-path }}
-          cache-dir: ${{ steps.db.outputs.cache-dir }}
-          output-dir: ${{ steps.fixture.outputs.reports }}
-          output-file: report.sarif
-      - name: Check output file exists
-        run: test -f "${{ steps.scan.outputs.output-path }}"
-
-  test-scan-image:
-    name: Test scan-image
-    runs-on:
-      - ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Trivy DB cache
-        id: db
-        uses: ./setup-db
-      - name: Prepare report directory
-        id: fixture
-        run: |
-          set -euo pipefail
-          reports="${{ runner.temp }}/trivy-ci-reports-image"
-          mkdir -p "$reports"
-          echo "reports=$reports" >> "$GITHUB_OUTPUT"
-      - name: Run scan-image
-        id: scan
-        uses: ./scan-image
-        with:
-          image: ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c
-          cache-dir: ${{ steps.db.outputs.cache-dir }}
-          output-dir: ${{ steps.fixture.outputs.reports }}
-          output-file: report.sarif
-      - name: Check output file exists
-        run: test -f "${{ steps.scan.outputs.output-path }}"
+          test -n "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}"
+          test "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}" = "${{ steps.setup-db.outputs.cache-dir }}"
+          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/Go/all.zip"
+          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/npm/all.zip"
+          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/PyPI/all.zip"
+          osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles .
 
   test-get-images-from-files:
     name: Test Get Images From Files
     runs-on:
       - ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - id: giff
         uses: ./get-images-from-files
         with:
@@ -173,7 +100,7 @@ jobs:
     runs-on:
       - ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Merge SARIF Files
         uses: ./merge-sarif-files
         with:

.gitea/workflows/prerelease.yaml

@@ -8,16 +8,16 @@ jobs:
     name: Prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@e393dbb067c09fd43519392572ccf63b66cba92d # 0.1.39
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: true
       - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@0841ccc70fc2c1526123785f3b0a510a6ba4bdfc # 0.2.7
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

README.md

@@ -1,3 +1,3 @@
-# Trivy Actions
+# OSV Scanner Actions
 
-Gitea compatible actions related to Trivy or the Trivy ecosystem.
+Gitea compatible actions related to osv-scanner or the OSV ecosystem.

renovate.json

@@ -1,26 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "local>t.behrendt/renovate-configs:common",
-    "local>t.behrendt/renovate-configs:action"
-  ],
-  "customManagers": [
-    {
-      "customType": "regex",
-      "description": "Update Trivy docker image",
-      "managerFilePatterns": [
-        "/(^|/)(setup-db|scan-config|scan-fs|scan-image)/action\\.ya?ml$/"
-      ],
-      "datasourceTemplate": "docker",
-      "matchStrings": [
-        "default:\\s*\"(?<depName>ghcr\\.io/aquasecurity/trivy):(?<currentValue>[\\d\\.]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\""
-      ]
-    }
-  ],
-  "packageRules": [
-    {
-      "matchManagers": ["dockerfile", "kubernetes", "helmfile", "helm-values"],
-      "ignorePaths": ["get-images-from-files/test*"]
-    }
-  ]
+  "extends": ["local>t.behrendt/renovate-configs:action"],
+  "enabledManagers": "github-actions"
 }

scan-config/README.md

@@ -1,57 +0,0 @@
-# Trivy scan (misconfiguration)
-
-Composite action that runs **`trivy config`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
-
-The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The vulnerability and policy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to resolve dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
-
-**Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
-
-## Prerequisites
-
-- Docker on the runner.
-- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
-
-## Usage
-
-```yaml
-- uses: actions/checkout@v4
-- name: Setup Trivy DB cache
-  id: db
-  uses: ./setup-db
-- name: Misconfiguration scan
-  id: scan
-  uses: ./scan-config
-  with:
-    scan-path: ${{ github.workspace }}
-    cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
-    output-file: misconfig.sarif
-- name: Upload report
-  uses: actions/upload-artifact@v4
-  with:
-    name: trivy-misconfig
-    path: ${{ steps.scan.outputs.output-path }}
-```
-
-## Inputs
-
-| Input           | Description                                                                 | Required | Default |
-| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
-| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
-| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
-| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
-
-**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
-
-## Outputs
-
-| Output         | Description                          |
-| -------------- | ------------------------------------ |
-| `output-path`  | Absolute path to the SARIF report on the host |
-
-## Notes
-
-- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
-- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-config/action.yaml

@@ -1,81 +0,0 @@
-name: "Trivy scan (misconfiguration)"
-description: "Run trivy config in a locked-down Docker container (misconfiguration / IaC); report is always SARIF"
-author: "Timo Behrendt <t.behrendt@t00n.de>"
-branding:
-  icon: "shield"
-  color: "blue"
-
-inputs:
-  scan-path:
-    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
-    required: true
-  cache-dir:
-    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
-    required: false
-    default: "${{ runner.temp }}/trivy"
-  output-dir:
-    description: "Host directory where the report file is written (mounted read-write at /out)"
-    required: true
-  output-file:
-    description: "SARIF report file name only (no slashes); written under output-dir"
-    required: true
-  trivy-version:
-    description: "Trivy Docker image reference (digest pin recommended)"
-    required: false
-    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
-
-outputs:
-  output-path:
-    description: "Host path to the generated report file"
-    value: ${{ steps.scan.outputs.output-path }}
-
-runs:
-  using: "composite"
-  steps:
-    - id: scan
-      shell: bash
-      env:
-        SCAN_PATH_IN: ${{ inputs.scan-path }}
-        CACHE_DIR_IN: ${{ inputs.cache-dir }}
-        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        TRIVY_IMAGE: ${{ inputs.trivy-version }}
-      run: |
-        set -euo pipefail
-        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        scan_path=$(realpath "$SCAN_PATH_IN")
-        cache_dir=$(realpath "$CACHE_DIR_IN")
-        mkdir -p "$OUTPUT_DIR_IN"
-        output_dir=$(realpath "$OUTPUT_DIR_IN")
-        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
-        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
-
-        docker run --rm \
-          --name trivy-scan-config \
-          --user "$(id -u):$(id -g)" \
-          --read-only \
-          --env-file /dev/null \
-          --cap-drop ALL \
-          --pids-limit 64 \
-          --memory=512m \
-          --memory-swap=512m \
-          --cpus=1 \
-          --ipc private \
-          --cgroupns private \
-          --security-opt no-new-privileges \
-          --security-opt apparmor=docker-default \
-          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
-          --network none \
-          --mount type=bind,src="$scan_path",dst=/scan,ro \
-          --mount type=bind,src="$cache_dir",dst=/cache,ro \
-          --mount type=bind,src="$output_dir",dst=/out \
-          "$TRIVY_IMAGE" \
-          config /scan \
-          --cache-dir /cache \
-          --skip-check-update \
-          --offline-scan \
-          --format sarif \
-          --exit-code 0 \
-          -o "/out/$OUTPUT_FILE"
-
-        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"

scan-fs/README.md

@@ -1,58 +0,0 @@
-# Trivy scan (filesystem)
-
-Composite action that runs **`trivy filesystem`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
-
-The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
-
-**Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
-
-## Prerequisites
-
-- Docker on the runner.
-- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
-
-## Usage
-
-```yaml
-- uses: actions/checkout@v4
-- name: Setup Trivy DB cache
-  id: db
-  uses: ./setup-db
-- name: Filesystem scan
-  id: scan
-  uses: ./scan-fs
-  with:
-    scan-path: ${{ github.workspace }}
-    cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
-    output-file: fs.sarif
-- name: Upload report
-  uses: actions/upload-artifact@v4
-  with:
-    name: trivy-fs
-    path: ${{ steps.scan.outputs.output-path }}
-```
-
-## Inputs
-
-| Input           | Description                                                                 | Required | Default |
-| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
-| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
-| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
-| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
-
-**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
-
-## Outputs
-
-| Output         | Description                          |
-| -------------- | ------------------------------------ |
-| `output-path`  | Absolute path to the SARIF report on the host |
-
-## Notes
-
-- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
-- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
-- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-fs/action.yaml

@@ -1,82 +0,0 @@
-name: "Trivy scan (filesystem)"
-description: "Run trivy filesystem in a locked-down Docker container; report is always SARIF"
-author: "Timo Behrendt <t.behrendt@t00n.de>"
-branding:
-  icon: "search"
-  color: "blue"
-
-inputs:
-  scan-path:
-    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
-    required: true
-  cache-dir:
-    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
-    required: false
-    default: "${{ runner.temp }}/trivy"
-  output-dir:
-    description: "Host directory where the report file is written (mounted read-write at /out)"
-    required: true
-  output-file:
-    description: "SARIF report file name only (no slashes); written under output-dir"
-    required: true
-  trivy-version:
-    description: "Trivy Docker image reference (digest pin recommended)"
-    required: false
-    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
-
-outputs:
-  output-path:
-    description: "Host path to the generated report file"
-    value: ${{ steps.scan.outputs.output-path }}
-
-runs:
-  using: "composite"
-  steps:
-    - id: scan
-      shell: bash
-      env:
-        SCAN_PATH_IN: ${{ inputs.scan-path }}
-        CACHE_DIR_IN: ${{ inputs.cache-dir }}
-        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        TRIVY_IMAGE: ${{ inputs.trivy-version }}
-      run: |
-        set -euo pipefail
-        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        scan_path=$(realpath "$SCAN_PATH_IN")
-        cache_dir=$(realpath "$CACHE_DIR_IN")
-        mkdir -p "$OUTPUT_DIR_IN"
-        output_dir=$(realpath "$OUTPUT_DIR_IN")
-        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
-        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
-
-        docker run --rm \
-          --name trivy-scan-fs \
-          --user "$(id -u):$(id -g)" \
-          --read-only \
-          --env-file /dev/null \
-          --cap-drop ALL \
-          --pids-limit 64 \
-          --memory=512m \
-          --memory-swap=512m \
-          --cpus=1 \
-          --ipc private \
-          --cgroupns private \
-          --security-opt no-new-privileges \
-          --security-opt apparmor=docker-default \
-          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
-          --network none \
-          --mount type=bind,src="$scan_path",dst=/scan,ro \
-          --mount type=bind,src="$cache_dir",dst=/cache,ro \
-          --mount type=bind,src="$output_dir",dst=/out \
-          "$TRIVY_IMAGE" \
-          filesystem /scan \
-          --cache-dir /cache \
-          --skip-db-update \
-          --skip-check-update \
-          --offline-scan \
-          --format sarif \
-          --exit-code 0 \
-          -o "/out/$OUTPUT_FILE"
-
-        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"

scan-image/README.md

@@ -1,57 +0,0 @@
-# Trivy scan (image)
-
-Composite action that runs **`trivy image`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
-
-You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Trivy pulls and scans it inside the container. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache` (**`--skip-db-update`** avoids re-downloading the DB). Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present). Image layers are still pulled over the network when needed.
-
-**Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)).
-
-## Prerequisites
-
-- Docker on the runner.
-- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
-
-## Usage
-
-```yaml
-- name: Setup Trivy DB cache
-  id: db
-  uses: ./setup-db
-- name: Image scan
-  id: scan
-  uses: ./scan-image
-  with:
-    image: alpine:3.20
-    cache-dir: ${{ steps.db.outputs.cache-dir }}
-    output-dir: ${{ runner.temp }}/trivy-reports
-    output-file: image.sarif
-- name: Upload report
-  uses: actions/upload-artifact@v4
-  with:
-    name: trivy-image
-    path: ${{ steps.scan.outputs.output-path }}
-```
-
-## Inputs
-
-| Input           | Description                                                                 | Required | Default |
-| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
-| `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
-| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
-| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
-| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
-| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
-
-**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
-
-## Outputs
-
-| Output         | Description                          |
-| -------------- | ------------------------------------ |
-| `output-path`  | Absolute path to the SARIF report on the host |
-
-## Notes
-
-- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
-- Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
-- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-image/action.yaml

@@ -1,77 +0,0 @@
-name: "Trivy scan (image)"
-description: "Run trivy image in a locked-down Docker container; report is always SARIF"
-author: "Timo Behrendt <t.behrendt@t00n.de>"
-branding:
-  icon: "package"
-  color: "blue"
-
-inputs:
-  image:
-    description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
-    required: true
-  cache-dir:
-    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
-    required: false
-    default: "${{ runner.temp }}/trivy"
-  output-dir:
-    description: "Host directory where the report file is written (mounted read-write at /out)"
-    required: true
-  output-file:
-    description: "SARIF report file name only (no slashes); written under output-dir"
-    required: true
-  trivy-version:
-    description: "Trivy Docker image reference (digest pin recommended)"
-    required: false
-    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
-
-outputs:
-  output-path:
-    description: "Host path to the generated report file"
-    value: ${{ steps.scan.outputs.output-path }}
-
-runs:
-  using: "composite"
-  steps:
-    - id: scan
-      shell: bash
-      env:
-        IMAGE_REF: ${{ inputs.image }}
-        CACHE_DIR_IN: ${{ inputs.cache-dir }}
-        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        TRIVY_IMAGE: ${{ inputs.trivy-version }}
-      run: |
-        set -euo pipefail
-        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
-        cache_dir=$(realpath "$CACHE_DIR_IN")
-        mkdir -p "$OUTPUT_DIR_IN"
-        output_dir=$(realpath "$OUTPUT_DIR_IN")
-        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
-
-        docker run --rm \
-          --name trivy-scan-image \
-          --user "$(id -u):$(id -g)" \
-          --read-only \
-          --env-file /dev/null \
-          --cap-drop ALL \
-          --pids-limit 64 \
-          --memory=512m \
-          --memory-swap=512m \
-          --cpus=1 \
-          --ipc private \
-          --cgroupns private \
-          --security-opt no-new-privileges \
-          --security-opt apparmor=docker-default \
-          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
-          --mount type=bind,src="$cache_dir",dst=/cache,ro \
-          --mount type=bind,src="$output_dir",dst=/out \
-          "$TRIVY_IMAGE" \
-          image "$IMAGE_REF" \
-          --cache-dir /cache \
-          --skip-db-update \
-          --offline-scan \
-          --format sarif \
-          --exit-code 0 \
-          -o "/out/$OUTPUT_FILE"
-
-        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"

setup-db/README.md

@@ -1,10 +1,8 @@
 # Setup DB Action
 
-A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
+A reusable Gitea Action that sets up the osv-scanner offline vulnerability database, restoring from cache if available.
 
-The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
-
-**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
+**Note:** This action only sets up the database. osv-scanner itself must be installed separately (e.g., using the `setup-osv` action). Subsequent steps receive `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` via the environment.
 
 ## Usage
 
@@ -12,7 +10,7 @@ The action runs Trivy inside **Docker** with a restricted container configuratio
 
 ```yaml
 - name: Setup DB
-  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
 ```
 
 ### Complete Example
@@ -28,19 +26,28 @@ jobs:
       - linux_amd64
     steps:
       - uses: actions/checkout@v4
-      - name: Setup Trivy
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
+      - name: Setup OSV Scanner
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-osv@0.0.1
+        with:
+          version: "v2.4.0"
+          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
       - name: Setup DB
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+        id: setup-db
+        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
       - name: Scan for vulnerabilities
-        run: trivy fs .
+        run: osv-scanner scan source --offline-vulnerabilities -r .
 ```
 
 ## Inputs
 
-| Input            | Description                                                                 | Required | Default |
-| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
-| `cache-dir`      | Path to the Trivy cache directory                                           | No       | `${{ runner.temp }}/trivy` |
-| `trivy-version`  | Docker image reference for Trivy (digest pin recommended)                   | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
+| Input         | Description                                                                 | Required | Default                          |
+| ------------- | --------------------------------------------------------------------------- | -------- | -------------------------------- |
+| `cache-dir`   | Path used as `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY`                         | No       | `${{ runner.temp }}/osv-scanner` |
+| `ecosystems`  | Comma-separated OSV ecosystems to download; empty downloads all ecosystems  | No       | _(all)_                          |
 
-**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.
+## Outputs
+
+| Output      | Description                                      |
+| ----------- | ------------------------------------------------ |
+| `cache-dir` | Path to the osv-scanner local DB cache directory |

setup-db/action.yaml

@@ -1,23 +1,23 @@
-name: "Setup Trivy DB"
-description: "Setup the trivy database, restoring from cache if available"
-author: "Timo Behrendt <t.behrendt@t00n.de"
+name: "Setup OSV Scanner DB"
+description: "Setup the osv-scanner offline vulnerability database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
 branding:
   icon: "database"
   color: "blue"
 
 inputs:
   cache-dir:
-    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    description: "Path used as OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{runner.temp}}/osv-scanner)"
     required: false
-    default: "${{ runner.temp }}/trivy"
-  trivy-version:
-    description: "Trivy docker image version to use (full image reference including digest is recommended)"
+    default: "${{ runner.temp }}/osv-scanner"
+  ecosystems:
+    description: "Comma-separated list of OSV ecosystems to download. Empty downloads all ecosystems."
     required: false
-    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+    default: ""
 
 outputs:
   cache-dir:
-    description: "Path to the Trivy cache directory"
+    description: "Path to the osv-scanner local DB cache directory"
     value: ${{ inputs.cache-dir }}
 
 runs:
@@ -28,29 +28,67 @@ runs:
       run: |
         echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
     - id: restore-db
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ inputs.cache-dir }}
-        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        key: osv-scanner-db-${{ steps.current-date.outputs.current-date }}
         restore-keys: |
-          trivy-db-${{ steps.current-date.outputs.current-date }}
-    - if: steps.restore-db.outputs.cache-hit != 'true'
+          osv-scanner-db-${{ steps.current-date.outputs.current-date }}
+    - name: Download offline databases
+      if: steps.restore-db.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker run --rm \
-          --name trivy-db-download \
-          --user "$(id -u):$(id -g)" \
-          --read-only \
-          --env-file /dev/null \
-          --cap-drop ALL \
-          --pids-limit 64 \
-          --memory=512m \
-          --memory-swap=512m \
-          --cpus=1 \
-          --ipc private \
-          --cgroupns private \
-          --security-opt no-new-privileges \
-          --security-opt apparmor=docker-default \
-          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
-          --mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
-          ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache
+        set -euo pipefail
+
+        CACHE_DIR="${{ inputs.cache-dir }}"
+        DB_DIR="${CACHE_DIR}/osv-scanner"
+        mkdir -p "${DB_DIR}"
+
+        ECOSYSTEMS_INPUT="${{ inputs.ecosystems }}"
+        if [ -n "${ECOSYSTEMS_INPUT}" ]; then
+          # shellcheck disable=SC2001
+          ECOSYSTEMS=$(echo "${ECOSYSTEMS_INPUT}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' || true)
+        else
+          ECOSYSTEMS=$(curl -fsSL https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt | grep -v '^$' | grep -v '^\[EMPTY\]$' || true)
+        fi
+
+        if [ -z "${ECOSYSTEMS}" ]; then
+          echo "No ecosystems to download" >&2
+          exit 1
+        fi
+
+        download_one() {
+          local ecosystem="$1"
+          local encoded
+          encoded=$(printf '%s' "${ecosystem}" | jq -sRr @uri)
+          local dest="${DB_DIR}/${ecosystem}"
+          mkdir -p "${dest}"
+          echo "Downloading ${ecosystem}..."
+          curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/${encoded}/all.zip" -o "${dest}/all.zip"
+        }
+
+        max_jobs=8
+        pids=()
+        while IFS= read -r ecosystem; do
+          [ -z "${ecosystem}" ] && continue
+          while [ "$(jobs -rp | wc -l)" -ge "${max_jobs}" ]; do
+            sleep 0.2
+          done
+          download_one "${ecosystem}" &
+          pids+=("$!")
+        done <<< "${ECOSYSTEMS}"
+
+        fail=0
+        for pid in "${pids[@]}"; do
+          wait "${pid}" || fail=1
+        done
+        if [ "${fail}" -ne 0 ]; then
+          echo "One or more ecosystem database downloads failed" >&2
+          exit 1
+        fi
+
+        echo "Downloaded $(find "${DB_DIR}" -name all.zip | wc -l) ecosystem database(s) to ${DB_DIR}"
+    - name: Export DB cache directory
+      shell: bash
+      run: |
+        echo "OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=${{ inputs.cache-dir }}" >> "$GITHUB_ENV"

setup-osv/README.md

@@ -0,0 +1,51 @@
+# Setup OSV Scanner Action
+
+A reusable Gitea Action that downloads and sets up the osv-scanner binary for vulnerability scanning.
+
+The downloaded binary is verified against a pinned SHA-256 digest for the runner architecture.
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup OSV Scanner
+  uses: your-username/osv-scanner-actions@main/setup-osv
+  with:
+    version: "v2.4.0"
+    amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+    arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
+```
+
+Digests are published in each release's `osv-scanner_SHA256SUMS` file (e.g. for `osv-scanner_linux_amd64` / `osv-scanner_linux_arm64`). You may pass either bare hex or `sha256:<hex>`.
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV Scanner
+        uses: your-username/osv-scanner-actions@main/setup-osv
+        with:
+          version: "v2.4.0"
+          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
+          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
+      - name: Scan for vulnerabilities
+        run: osv-scanner scan source -r .
+```
+
+## Inputs
+
+| Input          | Description                                                          | Required | Default |
+| -------------- | -------------------------------------------------------------------- | -------- | ------- |
+| `version`      | Explicit osv-scanner release tag (e.g. `v2.4.0`). `latest` is rejected | Yes      | —       |
+| `amd64-digest` | SHA-256 of `osv-scanner_linux_amd64` (hex or `sha256:<hex>`)         | Yes      | —       |
+| `arm64-digest` | SHA-256 of `osv-scanner_linux_arm64` (hex or `sha256:<hex>`)         | Yes      | —       |

setup-osv/action.yaml

@@ -0,0 +1,104 @@
+name: "Setup OSV Scanner"
+description: "Download and setup osv-scanner binary for vulnerability scanning"
+author: "Gitea Actions"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "osv-scanner version to download (e.g., v2.4.0). Must be an explicit release tag; 'latest' is not allowed."
+    required: true
+  amd64-digest:
+    description: "SHA-256 digest of the linux amd64 binary (hex or sha256:<hex>)"
+    required: true
+  arm64-digest:
+    description: "SHA-256 digest of the linux arm64 binary (hex or sha256:<hex>)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Resolve architecture and digest
+      shell: bash
+      id: arch
+      run: |
+        set -euo pipefail
+
+        VERSION="${{ inputs.version }}"
+        if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then
+          echo "version must be an explicit release tag (e.g. v2.4.0); 'latest' is not allowed" >&2
+          exit 1
+        fi
+
+        case "$(uname -m)" in
+          x86_64)
+            ARCH="amd64"
+            DIGEST="${{ inputs.amd64-digest }}"
+            ;;
+          aarch64)
+            ARCH="arm64"
+            DIGEST="${{ inputs.arm64-digest }}"
+            ;;
+          *)
+            echo "Unsupported architecture: $(uname -m)" >&2
+            exit 1
+            ;;
+        esac
+
+        if [ -z "${DIGEST}" ]; then
+          echo "Missing digest for architecture ${ARCH}" >&2
+          exit 1
+        fi
+
+        # Normalize sha256:<hex> / SHA256:<hex> to bare hex
+        DIGEST="${DIGEST#sha256:}"
+        DIGEST="${DIGEST#SHA256:}"
+
+        if ! [[ "${DIGEST}" =~ ^[a-fA-F0-9]{64}$ ]]; then
+          echo "Invalid ${ARCH} digest (expected 64-char hex or sha256:<hex>): ${DIGEST}" >&2
+          exit 1
+        fi
+
+        echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
+        echo "DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT"
+        echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+    - name: Cache osv-scanner binary
+      id: cache-osv
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: /usr/local/bin/osv-scanner
+        key: osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
+        restore-keys: |
+          osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
+    - name: Download and install osv-scanner
+      if: steps.cache-osv.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        VERSION="${{ steps.arch.outputs.version }}"
+        ARCH="${{ steps.arch.outputs.arch }}"
+        EXPECTED_DIGEST="${{ steps.arch.outputs.digest }}"
+        DEST="/usr/local/bin/osv-scanner"
+
+        mkdir -p /usr/local/bin
+
+        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "${DEST}"
+
+        ACTUAL_DIGEST=$(sha256sum "${DEST}" | awk '{print $1}')
+        if [ "${ACTUAL_DIGEST}" != "${EXPECTED_DIGEST}" ]; then
+          echo "Digest mismatch for osv-scanner ${VERSION} (linux_${ARCH})" >&2
+          echo "  expected: ${EXPECTED_DIGEST}" >&2
+          echo "  actual:   ${ACTUAL_DIGEST}" >&2
+          rm -f "${DEST}"
+          exit 1
+        fi
+
+        chmod +x "${DEST}"
+        echo "Verified osv-scanner ${VERSION} (linux_${ARCH}) digest ${ACTUAL_DIGEST}"
+
+    - name: Add osv-scanner to PATH
+      shell: bash
+      run: |
+        echo "/usr/local/bin" >> "$GITHUB_PATH"