Compare commits
7 Commits
db1011147f
..
0.0.4
| Author | SHA1 | Date | |
|---|---|---|---|
 renovate-bot
|
31859149c1 | ||
|
renovate-bot
|
3c4aeb81f4 | ||
 t.behrendt
|
2616391b42 | ||
|
t.behrendt
|
81eda53a59 | ||
|
renovate-bot
|
a9ff551b88 | ||
|
renovate-bot
|
a6508d695d | ||
|
renovate-bot
|
6122c9ee30 |
@@ -10,15 +10,15 @@ jobs:
|
||||
name: Release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Increment tag
|
||||
id: tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
- name: Push tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
|
||||
with:
|
||||
tag: ${{ steps.tag.outputs.new-tag }}
|
||||
|
||||
+25
-20
@@ -4,35 +4,40 @@ on:
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
test-setup-osv-db:
|
||||
name: Test Setup OSV offline DB
|
||||
test-setup-trivy:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
name: Test Setup Trivy ${{ matrix.arch }}
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
- linux_${{ matrix.arch }}
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- name: Setup Trivy
|
||||
uses: ./setup-trivy
|
||||
- name: Run Trivy
|
||||
run: trivy --version
|
||||
|
||||
test-setup-db:
|
||||
name: Test Setup DB
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- name: Setup offline DB
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: ./setup-trivy
|
||||
- name: Setup DB
|
||||
id: setup-db
|
||||
uses: ./setup-osv-db
|
||||
- name: Verify DB zips exist
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
root="${{ steps.setup-db.outputs.cache-dir }}/osv-scanner"
|
||||
[ -d "$root" ] || { echo "FAIL: missing directory $root"; exit 1; }
|
||||
n=0
|
||||
while IFS= read -r -d '' f; do
|
||||
[ -s "$f" ] || { echo "FAIL: empty or missing: $f"; exit 1; }
|
||||
n=$((n + 1))
|
||||
done < <(find "$root" -type f -name all.zip -print0)
|
||||
[ "$n" -ge 1 ] || { echo "FAIL: no all.zip under $root"; exit 1; }
|
||||
echo "OK: $n non-empty all.zip file(s) under $root"
|
||||
uses: ./setup-db
|
||||
- name: Run Trivy
|
||||
run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
|
||||
|
||||
test-get-images-from-files:
|
||||
name: Test Get Images From Files
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- id: giff
|
||||
uses: ./get-images-from-files
|
||||
with:
|
||||
@@ -83,7 +88,7 @@ jobs:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- name: Merge SARIF Files
|
||||
uses: ./merge-sarif-files
|
||||
with:
|
||||
|
||||
@@ -8,16 +8,16 @@ jobs:
|
||||
name: Prerelease
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Increment tag
|
||||
id: tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
prerelease: true
|
||||
- name: Push tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
|
||||
with:
|
||||
tag: ${{ steps.tag.outputs.new-tag }}
|
||||
|
||||
@@ -1,20 +1,3 @@
|
||||
# OSV-Scanner Actions
|
||||
# Trivy Actions
|
||||
|
||||
Gitea-compatible composite actions around [Google OSV-Scanner](https://github.com/google/osv-scanner): cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. Install the `osv-scanner` CLI from [upstream releases](https://github.com/google/osv-scanner/releases) (or your package manager) in your workflow.
|
||||
|
||||
## Actions
|
||||
|
||||
| Directory | Purpose |
|
||||
| ---------------------- | ----------------------------------------------------------------------- |
|
||||
| `setup-osv-db` | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list. |
|
||||
| `merge-sarif-files` | Merge multiple SARIF files into one (tool-agnostic). |
|
||||
| `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). |
|
||||
|
||||
## Workflows
|
||||
|
||||
- **CI** (`.gitea/workflows/ci.yaml`): tests the actions above on `pull_request`.
|
||||
- **CD / Prerelease**: tag bump workflows unchanged (no scanner).
|
||||
|
||||
## Documentation
|
||||
|
||||
Each action directory has its own `README.md` with inputs, outputs, and examples.
|
||||
Gitea compatible actions related to Trivy or the Trivy ecosystem.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Get Images From Files Action
|
||||
|
||||
A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated. Use the list with `osv-scanner scan image <ref>` (or a loop in CI) to scan container images.
|
||||
A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated.
|
||||
|
||||
**Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged.
|
||||
|
||||
@@ -21,7 +21,7 @@ Other files are supported if they use one of these patterns (e.g. `image:` or `F
|
||||
|
||||
```yaml
|
||||
- name: Get Images From Files
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
|
||||
with:
|
||||
files: |
|
||||
- Dockerfile
|
||||
@@ -42,7 +42,7 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Get Images From Files
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
|
||||
with:
|
||||
files: |
|
||||
- Dockerfile
|
||||
|
||||
@@ -10,7 +10,7 @@ A reusable Gitea Action that merges multiple SARIF files into a single SARIF fil
|
||||
|
||||
```yaml
|
||||
- name: Merge SARIF Files
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1
|
||||
with:
|
||||
files: |
|
||||
- test_sarif1.json
|
||||
@@ -30,7 +30,7 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Merge SARIF Files
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1
|
||||
with:
|
||||
files: |
|
||||
- test_sarif1.json
|
||||
|
||||
@@ -5,9 +5,9 @@
|
||||
{
|
||||
"tool": {
|
||||
"driver": {
|
||||
"fullName": "OSV-Scanner",
|
||||
"informationUri": "https://github.com/google/osv-scanner",
|
||||
"name": "OSV-Scanner",
|
||||
"fullName": "Trivy Vulnerability Scanner",
|
||||
"informationUri": "https://github.com/aquasecurity/trivy",
|
||||
"name": "Trivy",
|
||||
"rules": [
|
||||
{
|
||||
"id": "KSV-0014",
|
||||
|
||||
@@ -5,9 +5,9 @@
|
||||
{
|
||||
"tool": {
|
||||
"driver": {
|
||||
"fullName": "OSV-Scanner",
|
||||
"informationUri": "https://github.com/google/osv-scanner",
|
||||
"name": "OSV-Scanner",
|
||||
"fullName": "Trivy Vulnerability Scanner",
|
||||
"informationUri": "https://github.com/aquasecurity/trivy",
|
||||
"name": "Trivy",
|
||||
"rules": [
|
||||
{
|
||||
"id": "CVE-2026-26019",
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"local>t.behrendt/renovate-configs:common",
|
||||
"local>t.behrendt/renovate-configs:action"
|
||||
],
|
||||
"packageRules": [
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
# Setup DB Action
|
||||
|
||||
A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
|
||||
|
||||
**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
|
||||
|
||||
## Usage
|
||||
|
||||
### Basic Usage
|
||||
|
||||
```yaml
|
||||
- name: Setup DB
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
||||
```
|
||||
|
||||
### Complete Example
|
||||
|
||||
```yaml
|
||||
name: Security Scan
|
||||
on: [push, pull_request]
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
- linux_amd64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup Trivy
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
|
||||
- name: Setup DB
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
||||
- name: Scan for vulnerabilities
|
||||
run: trivy fs .
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| ----------- | --------------------------------- | -------- | ---------------- |
|
||||
| `cache-dir` | Path to the Trivy cache directory | No | `~/.cache/trivy` |
|
||||
@@ -0,0 +1,35 @@
|
||||
name: "Setup Trivy DB"
|
||||
description: "Setup the trivy database, restoring from cache if available"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de"
|
||||
branding:
|
||||
icon: "database"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
cache-dir:
|
||||
description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
|
||||
required: false
|
||||
default: "${{ runner.temp }}/trivy"
|
||||
|
||||
outputs:
|
||||
cache-dir:
|
||||
description: "Path to the Trivy cache directory"
|
||||
value: ${{ inputs.cache-dir }}
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- id: current-date
|
||||
shell: bash
|
||||
run: |
|
||||
echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
|
||||
- id: restore-db
|
||||
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
||||
with:
|
||||
path: ${{ inputs.cache-dir }}
|
||||
key: trivy-db-${{ steps.current-date.outputs.current-date }}
|
||||
restore-keys: |
|
||||
trivy-db-${{ steps.current-date.outputs.current-date }}
|
||||
- if: steps.restore-db.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"
|
||||
@@ -1,65 +0,0 @@
|
||||
# Setup OSV offline DB Action
|
||||
|
||||
A reusable Gitea Action that restores or populates the [OSV-Scanner local vulnerability cache](https://google.github.io/osv-scanner/usage/offline-mode/) used with `--offline-vulnerabilities`.
|
||||
|
||||
Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.googleapis.com/` as described under [Manual database download](https://google.github.io/osv-scanner/usage/offline-mode/#manual-database-download): for each requested ecosystem, download `…/<ecosystem>/all.zip` into `osv-scanner/<ecosystem>/all.zip`. **OSV-Scanner is not invoked** for downloads.
|
||||
|
||||
**Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths).
|
||||
|
||||
**Note:** This action only prepares the local DB directory. Install the scanner separately.
|
||||
|
||||
## Ecosystems input
|
||||
|
||||
Use **`ecosystems`**: a comma-separated list (spaces around commas are trimmed). Each token is matched to an entry from [ecosystems.txt](https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt) by:
|
||||
|
||||
- **Slug match:** lowercased, spaces → `-`, brackets removed (e.g. `GitHub Actions` and `github-actions` both match).
|
||||
- **Special case:** `docker` is not an OSV ecosystem; it is treated as **`Linux`** (useful as a default when scanning image-related data). Override with `Alpine`, `Debian`, etc. if you prefer.
|
||||
|
||||
The **`actions/cache` key includes** the sorted, slugified list of resolved ecosystems (e.g. `github-actions,go,linux,npm`) plus the hour bucket settings, so different ecosystem sets never share a cache entry.
|
||||
|
||||
## Usage
|
||||
|
||||
```yaml
|
||||
uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
|
||||
with:
|
||||
ecosystems: PyPI,npm,Go
|
||||
```
|
||||
|
||||
## Example workflow
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
scan:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup offline DB
|
||||
id: setup-db
|
||||
uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
|
||||
with:
|
||||
cache-bucket-hours: 6
|
||||
ecosystems: github-actions,npm,go,Alpine
|
||||
- name: Scan (offline vulnerabilities only)
|
||||
env:
|
||||
OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }}
|
||||
run: osv-scanner scan source --offline-vulnerabilities -r .
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Required | Default |
|
||||
| -------------------- | ------------------------------------------------------------------------- | -------- | -------------------------------- |
|
||||
| `cache-dir` | Directory for `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` | No | `${{ runner.temp }}/osv-scanner` |
|
||||
| `cache-bucket-hours` | `actions/cache` primary key includes `floor(UTC unix time / (3600 × N))`. | No | `24` |
|
||||
| `ecosystems` | Comma-separated tokens (names/slugs; `docker` → `Linux`). | No | `github-actions,npm,go,docker` |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
| ----------- | ------------------ |
|
||||
| `cache-dir` | Same as input path |
|
||||
|
||||
## Behavior
|
||||
|
||||
- **Cache:** Key pattern `osv-scanner-db-{hours}h-eco-{sorted-slugs}-{bucket}`. `restore-keys` reuse the newest cache for the same hours + ecosystem set when the current time bucket misses.
|
||||
- **Populate:** On cache miss, `${cache-dir}/osv-scanner` is recreated and only the requested ecosystems are downloaded.
|
||||
@@ -1,143 +0,0 @@
|
||||
name: "Setup OSV offline vulnerability DB"
|
||||
description: "Populate or restore the OSV-Scanner local vulnerability database cache (offline mode)"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de>"
|
||||
branding:
|
||||
icon: "database"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
cache-dir:
|
||||
description: "Directory for OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{ runner.temp }}/osv-scanner)"
|
||||
required: false
|
||||
default: "${{ runner.temp }}/osv-scanner"
|
||||
cache-bucket-hours:
|
||||
description: "actions/cache key advances every this many full hours (UTC, since epoch). Example: 24 ≈ daily bucket; 1 = new key each hour."
|
||||
required: false
|
||||
default: "24"
|
||||
ecosystems:
|
||||
description: "Comma-separated ecosystem tokens (slug or official name, see README). OSV has no Docker Hub bucket; token `docker` installs the `Linux` ecosystem as a practical default for image-style data."
|
||||
required: false
|
||||
default: "github-actions,npm,go,docker"
|
||||
|
||||
outputs:
|
||||
cache-dir:
|
||||
description: "Path passed to OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY"
|
||||
value: ${{ inputs.cache-dir }}
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- id: prepare
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
slugify() {
|
||||
local s="$1"
|
||||
s=$(printf '%s' "$s" | tr '[:upper:]' '[:lower:]')
|
||||
s=$(printf '%s' "$s" | sed 's/\[//g;s/\]//g')
|
||||
s=$(printf '%s' "$s" | sed 's/[[:space:]]\+/-/g')
|
||||
printf '%s' "$s"
|
||||
}
|
||||
|
||||
HOURS="${{ inputs.cache-bucket-hours }}"
|
||||
case "$HOURS" in
|
||||
''|*[!0-9]*) echo "cache-bucket-hours must be a positive integer, got: $HOURS" >&2; exit 1 ;;
|
||||
esac
|
||||
if [ "$HOURS" -lt 1 ]; then
|
||||
echo "cache-bucket-hours must be >= 1" >&2
|
||||
exit 1
|
||||
fi
|
||||
bucket=$(( $(date -u +%s) / (3600 * HOURS) ))
|
||||
echo "hours=$HOURS" >> "$GITHUB_OUTPUT"
|
||||
echo "bucket=$bucket" >> "$GITHUB_OUTPUT"
|
||||
|
||||
RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
|
||||
RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
|
||||
: > "$RESOLVED_FILE"
|
||||
|
||||
ecosystems_all="$(mktemp)"
|
||||
curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt" -o "$ecosystems_all"
|
||||
|
||||
declare -A SLUG_TO_OFFICIAL=()
|
||||
while IFS= read -r line || [ -n "$line" ]; do
|
||||
line="${line//$'\r'/}"
|
||||
[ -z "$line" ] && continue
|
||||
slug=$(slugify "$line")
|
||||
SLUG_TO_OFFICIAL["$slug"]="$line"
|
||||
done < "$ecosystems_all"
|
||||
rm -f "$ecosystems_all"
|
||||
|
||||
declare -A SEEN_CANONICAL=()
|
||||
INPUT="${{ inputs.ecosystems }}"
|
||||
INPUT="${INPUT//$'\r'/}"
|
||||
if [ -z "${INPUT//[[:space:]]/}" ]; then
|
||||
echo "ecosystems input is empty" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IFS=',' read -ra PARTS <<< "$INPUT"
|
||||
for raw in "${PARTS[@]}"; do
|
||||
token=$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
|
||||
[ -z "$token" ] && continue
|
||||
tslug=$(slugify "$token")
|
||||
if [ "$tslug" = "docker" ]; then
|
||||
official="Linux"
|
||||
elif [ -n "${SLUG_TO_OFFICIAL[$tslug]+x}" ]; then
|
||||
official="${SLUG_TO_OFFICIAL[$tslug]}"
|
||||
else
|
||||
echo "Unknown ecosystem token: ${token}. Valid names/slugs match https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt (token docker -> Linux)." >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "${SEEN_CANONICAL[$official]+x}" ]; then
|
||||
SEEN_CANONICAL[$official]=1
|
||||
printf '%s\n' "$official" >> "$RESOLVED_FILE"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ ! -s "$RESOLVED_FILE" ]; then
|
||||
echo "No ecosystems resolved from input" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
slug_keys=()
|
||||
while IFS= read -r official || [ -n "$official" ]; do
|
||||
[ -z "$official" ] && continue
|
||||
slug_keys+=("$(slugify "$official")")
|
||||
done < "$RESOLVED_FILE"
|
||||
ecosystems_key=$(printf '%s\n' "${slug_keys[@]}" | sort -u | paste -sd, -)
|
||||
echo "ecosystems-key=$ecosystems_key" >> "$GITHUB_OUTPUT"
|
||||
- id: restore-db
|
||||
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
||||
with:
|
||||
path: ${{ inputs.cache-dir }}
|
||||
key: osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-${{ steps.prepare.outputs.bucket }}
|
||||
restore-keys: |
|
||||
osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-
|
||||
- if: steps.restore-db.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
CACHE_DIR="${{ inputs.cache-dir }}"
|
||||
ROOT="${CACHE_DIR}/osv-scanner"
|
||||
BASE="https://osv-vulnerabilities.storage.googleapis.com"
|
||||
RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
|
||||
RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
|
||||
|
||||
rm -rf "$ROOT"
|
||||
mkdir -p "$ROOT"
|
||||
|
||||
if [ ! -s "$RESOLVED_FILE" ]; then
|
||||
echo "Missing resolved ecosystem list at $RESOLVED_FILE" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
while IFS= read -r ecosystem || [ -n "$ecosystem" ]; do
|
||||
[ -z "$ecosystem" ] && continue
|
||||
enc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$ecosystem")"
|
||||
dest_dir="${ROOT}/${ecosystem}"
|
||||
mkdir -p "$dest_dir"
|
||||
tmp="$(mktemp)"
|
||||
curl -fsSL "${BASE}/${enc}/all.zip" -o "$tmp"
|
||||
mv "$tmp" "${dest_dir}/all.zip"
|
||||
done < "$RESOLVED_FILE"
|
||||
@@ -0,0 +1,39 @@
|
||||
# Setup Trivy Action
|
||||
|
||||
A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning.
|
||||
|
||||
## Usage
|
||||
|
||||
### Basic Usage
|
||||
|
||||
```yaml
|
||||
- name: Setup Trivy
|
||||
uses: your-username/trivy-actions@main/setup-trivy
|
||||
with:
|
||||
version: "v0.66.0" # Optional: Trivy version (default: latest)
|
||||
```
|
||||
|
||||
### Complete Example
|
||||
|
||||
```yaml
|
||||
name: Security Scan
|
||||
on: [push, pull_request]
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
- linux_amd64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup Trivy
|
||||
uses: your-username/trivy-actions@main/setup-trivy
|
||||
- name: Scan for vulnerabilities
|
||||
run: trivy fs .
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| --------- | ----------------------------------------- | -------- | -------- |
|
||||
| `version` | Trivy version to download (e.g., v0.66.0) | No | `latest` |
|
||||
@@ -0,0 +1,68 @@
|
||||
name: "Setup Trivy"
|
||||
description: "Download and setup Trivy binary for vulnerability scanning"
|
||||
author: "Gitea Actions"
|
||||
branding:
|
||||
icon: "shield"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
version:
|
||||
description: "Trivy version to download (e.g., latest)"
|
||||
required: false
|
||||
default: "latest"
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- shell: bash
|
||||
id: arch
|
||||
run: |
|
||||
set -e
|
||||
case "$(uname -m)" in
|
||||
x86_64)
|
||||
ARCH="64bit"
|
||||
;;
|
||||
aarch64)
|
||||
ARCH="ARM64"
|
||||
;;
|
||||
esac
|
||||
echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
|
||||
- name: Resolve version
|
||||
shell: bash
|
||||
id: version
|
||||
run: |
|
||||
set -e
|
||||
if [ "${{ inputs.version }}" = "latest" ]; then
|
||||
VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name')
|
||||
else
|
||||
VERSION="${{ inputs.version }}"
|
||||
fi
|
||||
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
|
||||
- name: Cache Trivy binary
|
||||
id: cache-trivy
|
||||
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
||||
with:
|
||||
path: /usr/local/bin/trivy
|
||||
key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
|
||||
restore-keys: |
|
||||
trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
|
||||
- name: Download and install Trivy
|
||||
if: steps.cache-trivy.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
set -e
|
||||
|
||||
VERSION="${{ steps.version.outputs.version }}"
|
||||
|
||||
mkdir -p /usr/local/bin
|
||||
|
||||
curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${{ steps.arch.outputs.arch }}.tar.gz" -o trivy.tar.gz
|
||||
tar -xzf trivy.tar.gz
|
||||
chmod +x trivy
|
||||
mv trivy /usr/local/bin/
|
||||
rm trivy.tar.gz
|
||||
|
||||
- name: Add Trivy to PATH
|
||||
shell: bash
|
||||
run: |
|
||||
echo "/usr/local/bin" >> $GITHUB_PATH
|
||||
Reference in New Issue
Block a user