run on experimental dind runner

As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised.
Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date.

Reviewed-on: #54
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

.gitea/workflows/cd.yaml

@@ -15,10 +15,10 @@ jobs:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
         with:
           token: ${{ secrets.GITEA_TOKEN }}
       - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -4,28 +4,118 @@ on:
   pull_request:
 
 jobs:
-  test-setup-osv-db:
+  test-setup-db:
-    name: Test Setup OSV offline DB
+    name: Test Setup DB
+    runs-on:
+      - ubuntu-latest
+      - experimental
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup DB
+        id: setup-db
+        uses: ./setup-db
+      - name: Verify vulnerability DB in cache
+        run: |
+          set -euo pipefail
+          cache="${{ steps.setup-db.outputs.cache-dir }}"
+          db="$cache/db/trivy.db"
+          meta="$cache/db/metadata.json"
+          test -f "$meta" || { echo "FAIL: $meta missing (DB not downloaded?)"; exit 1; }
+          test -f "$db" || { echo "FAIL: $db missing (DB not downloaded?)"; exit 1; }
+          size=$(stat -c%s "$db")
+          min=$((3 * 1024 * 1024))
+          if [ "$size" -lt "$min" ]; then
+            echo "FAIL: trivy.db too small ($size bytes; expected at least $min bytes, i.e. a few MiB)"
+            exit 1
+          fi
+          echo "OK: trivy.db is present ($size bytes) and metadata.json exists."
+
+  test-scan-config:
+    name: Test scan-config
     runs-on:
       - ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup offline DB
+      - name: Setup Trivy DB cache
-        id: setup-db
+        id: db
-        uses: ./setup-osv-db
+        uses: ./setup-db
-      - name: Verify DB zips exist
+      - name: Create ephemeral config fixture
-        shell: bash
+        id: fixture
         run: |
           set -euo pipefail
-          root="${{ steps.setup-db.outputs.cache-dir }}/osv-scanner"
+          scan="${{ runner.temp }}/trivy-ci-scan-config"
-          [ -d "$root" ] || { echo "FAIL: missing directory $root"; exit 1; }
+          reports="${{ runner.temp }}/trivy-ci-reports-config"
-          n=0
+          mkdir -p "$scan" "$reports"
-          while IFS= read -r -d '' f; do
+          printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
-            [ -s "$f" ] || { echo "FAIL: empty or missing: $f"; exit 1; }
+          echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
-            n=$((n + 1))
+          echo "reports=$reports" >> "$GITHUB_OUTPUT"
-          done < <(find "$root" -type f -name all.zip -print0)
+      - name: Run scan-config
-          [ "$n" -ge 1 ] || { echo "FAIL: no all.zip under $root"; exit 1; }
+        id: scan
-          echo "OK: $n non-empty all.zip file(s) under $root"
+        uses: ./scan-config
+        with:
+          scan-path: ${{ steps.fixture.outputs.scan-path }}
+          cache-dir: ${{ steps.db.outputs.cache-dir }}
+          output-dir: ${{ steps.fixture.outputs.reports }}
+          output-file: report.sarif
+      - name: Check output file exists
+        run: test -f "${{ steps.scan.outputs.output-path }}"
+
+  test-scan-fs:
+    name: Test scan-fs
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Trivy DB cache
+        id: db
+        uses: ./setup-db
+      - name: Create ephemeral filesystem fixture
+        id: fixture
+        run: |
+          set -euo pipefail
+          scan="${{ runner.temp }}/trivy-ci-scan-fs"
+          reports="${{ runner.temp }}/trivy-ci-reports-fs"
+          mkdir -p "$scan" "$reports"
+          printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
+          echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
+          echo "reports=$reports" >> "$GITHUB_OUTPUT"
+      - name: Run scan-fs
+        id: scan
+        uses: ./scan-fs
+        with:
+          scan-path: ${{ steps.fixture.outputs.scan-path }}
+          cache-dir: ${{ steps.db.outputs.cache-dir }}
+          output-dir: ${{ steps.fixture.outputs.reports }}
+          output-file: report.sarif
+      - name: Check output file exists
+        run: test -f "${{ steps.scan.outputs.output-path }}"
+
+  test-scan-image:
+    name: Test scan-image
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Trivy DB cache
+        id: db
+        uses: ./setup-db
+      - name: Prepare report directory
+        id: fixture
+        run: |
+          set -euo pipefail
+          reports="${{ runner.temp }}/trivy-ci-reports-image"
+          mkdir -p "$reports"
+          echo "reports=$reports" >> "$GITHUB_OUTPUT"
+      - name: Run scan-image
+        id: scan
+        uses: ./scan-image
+        with:
+          image: ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c
+          cache-dir: ${{ steps.db.outputs.cache-dir }}
+          output-dir: ${{ steps.fixture.outputs.reports }}
+          output-file: report.sarif
+      - name: Check output file exists
+        run: test -f "${{ steps.scan.outputs.output-path }}"
 
   test-get-images-from-files:
     name: Test Get Images From Files

.gitea/workflows/prerelease.yaml

@@ -13,11 +13,11 @@ jobs:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: true
       - name: Push tag
-        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4
+        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

README.md

@@ -1,20 +1,3 @@
-# OSV-Scanner Actions
+# Trivy Actions
 
-Gitea-compatible composite actions around [Google OSV-Scanner](https://github.com/google/osv-scanner): cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. Install the `osv-scanner` CLI from [upstream releases](https://github.com/google/osv-scanner/releases) (or your package manager) in your workflow.
+Gitea compatible actions related to Trivy or the Trivy ecosystem.
-
-## Actions
-
-| Directory              | Purpose                                                                 |
-| ---------------------- | ----------------------------------------------------------------------- |
-| `setup-osv-db`         | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list.        |
-| `merge-sarif-files`    | Merge multiple SARIF files into one (tool-agnostic).                  |
-| `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). |
-
-## Workflows
-
-- **CI** (`.gitea/workflows/ci.yaml`): tests the actions above on `pull_request`.
-- **CD / Prerelease**: tag bump workflows unchanged (no scanner).
-
-## Documentation
-
-Each action directory has its own `README.md` with inputs, outputs, and examples.

get-images-from-files/README.md

@@ -1,6 +1,6 @@
 # Get Images From Files Action
 
-A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated. Use the list with `osv-scanner scan image <ref>` (or a loop in CI) to scan container images.
+A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated.
 
 **Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged.
 
@@ -21,7 +21,7 @@ Other files are supported if they use one of these patterns (e.g. `image:` or `F
 
 ```yaml
 - name: Get Images From Files
-  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
   with:
     files: |
         - Dockerfile
@@ -42,7 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Get Images From Files
-        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/get-images-from-files@0.0.1
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
         with:
             files: |
               - Dockerfile

merge-sarif-files/README.md

@@ -10,7 +10,7 @@ A reusable Gitea Action that merges multiple SARIF files into a single SARIF fil
 
 ```yaml
 - name: Merge SARIF Files
-  uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1
   with:
     files: |
       - test_sarif1.json
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Merge SARIF Files
-        uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/merge-sarif-files@0.0.1
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@0.0.1
         with:
           files: |
             - test_sarif1.json

merge-sarif-files/test_sarif1.json

@@ -5,9 +5,9 @@
     {
       "tool": {
         "driver": {
-          "fullName": "OSV-Scanner",
+          "fullName": "Trivy Vulnerability Scanner",
-          "informationUri": "https://github.com/google/osv-scanner",
+          "informationUri": "https://github.com/aquasecurity/trivy",
-          "name": "OSV-Scanner",
+          "name": "Trivy",
           "rules": [
             {
               "id": "KSV-0014",

merge-sarif-files/test_sarif2.json

@@ -5,9 +5,9 @@
     {
       "tool": {
         "driver": {
-          "fullName": "OSV-Scanner",
+          "fullName": "Trivy Vulnerability Scanner",
-          "informationUri": "https://github.com/google/osv-scanner",
+          "informationUri": "https://github.com/aquasecurity/trivy",
-          "name": "OSV-Scanner",
+          "name": "Trivy",
           "rules": [
             {
               "id": "CVE-2026-26019",

renovate.json

@@ -1,8 +1,22 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
+    "local>t.behrendt/renovate-configs:common",
     "local>t.behrendt/renovate-configs:action"
   ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Update Trivy docker image",
+      "managerFilePatterns": [
+        "/(^|/)(setup-db|scan-config|scan-fs|scan-image)/action\\.ya?ml$/"
+      ],
+      "datasourceTemplate": "docker",
+      "matchStrings": [
+        "default:\\s*\"(?<depName>ghcr\\.io/aquasecurity/trivy):(?<currentValue>[\\d\\.]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\""
+      ]
+    }
+  ],
   "packageRules": [
     {
       "matchManagers": ["dockerfile", "kubernetes", "helmfile", "helm-values"],

scan-config/README.md

@@ -0,0 +1,57 @@
+# Trivy scan (misconfiguration)
+
+Composite action that runs **`trivy config`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The vulnerability and policy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to resolve dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
+
+**Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- uses: actions/checkout@v4
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Misconfiguration scan
+  id: scan
+  uses: ./scan-config
+  with:
+    scan-path: ${{ github.workspace }}
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: misconfig.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-misconfig
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-config/action.yaml

@@ -0,0 +1,81 @@
+name: "Trivy scan (misconfiguration)"
+description: "Run trivy config in a locked-down Docker container (misconfiguration / IaC); report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  scan-path:
+    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
+    required: true
+  cache-dir:
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Host directory where the report file is written (mounted read-write at /out)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        SCAN_PATH_IN: ${{ inputs.scan-path }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        scan_path=$(realpath "$SCAN_PATH_IN")
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-config \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --network none \
+          --mount type=bind,src="$scan_path",dst=/scan,ro \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          config /scan \
+          --cache-dir /cache \
+          --skip-check-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"

scan-fs/README.md

@@ -0,0 +1,58 @@
+# Trivy scan (filesystem)
+
+Composite action that runs **`trivy filesystem`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
+
+**Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- uses: actions/checkout@v4
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Filesystem scan
+  id: scan
+  uses: ./scan-fs
+  with:
+    scan-path: ${{ github.workspace }}
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: fs.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-fs
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
+- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-fs/action.yaml

@@ -0,0 +1,82 @@
+name: "Trivy scan (filesystem)"
+description: "Run trivy filesystem in a locked-down Docker container; report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "search"
+  color: "blue"
+
+inputs:
+  scan-path:
+    description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
+    required: true
+  cache-dir:
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Host directory where the report file is written (mounted read-write at /out)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        SCAN_PATH_IN: ${{ inputs.scan-path }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        scan_path=$(realpath "$SCAN_PATH_IN")
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-fs \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --network none \
+          --mount type=bind,src="$scan_path",dst=/scan,ro \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          filesystem /scan \
+          --cache-dir /cache \
+          --skip-db-update \
+          --skip-check-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"

scan-image/README.md

@@ -0,0 +1,57 @@
+# Trivy scan (image)
+
+Composite action that runs **`trivy image`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
+
+You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Trivy pulls and scans it inside the container. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache` (**`--skip-db-update`** avoids re-downloading the DB). Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present). Image layers are still pulled over the network when needed.
+
+**Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)).
+
+## Prerequisites
+
+- Docker on the runner.
+- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
+
+## Usage
+
+```yaml
+- name: Setup Trivy DB cache
+  id: db
+  uses: ./setup-db
+- name: Image scan
+  id: scan
+  uses: ./scan-image
+  with:
+    image: alpine:3.20
+    cache-dir: ${{ steps.db.outputs.cache-dir }}
+    output-dir: ${{ runner.temp }}/trivy-reports
+    output-file: image.sarif
+- name: Upload report
+  uses: actions/upload-artifact@v4
+  with:
+    name: trivy-image
+    path: ${{ steps.scan.outputs.output-path }}
+```
+
+## Inputs
+
+| Input           | Description                                                                 | Required | Default |
+| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `image`         | Image reference to scan (pulled inside the container)                       | Yes      | —       |
+| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
+| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
+| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
+| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |
+
+**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
+
+## Outputs
+
+| Output         | Description                          |
+| -------------- | ------------------------------------ |
+| `output-path`  | Absolute path to the SARIF report on the host |
+
+## Notes
+
+- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
+- Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
+- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).

scan-image/action.yaml

@@ -0,0 +1,77 @@
+name: "Trivy scan (image)"
+description: "Run trivy image in a locked-down Docker container; report is always SARIF"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "package"
+  color: "blue"
+
+inputs:
+  image:
+    description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
+    required: true
+  cache-dir:
+    description: "Host path to the Trivy cache directory (mounted read-only at /cache; use the same path as setup-db)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  output-dir:
+    description: "Host directory where the report file is written (mounted read-write at /out)"
+    required: true
+  output-file:
+    description: "SARIF report file name only (no slashes); written under output-dir"
+    required: true
+  trivy-version:
+    description: "Trivy Docker image reference (digest pin recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  output-path:
+    description: "Host path to the generated report file"
+    value: ${{ steps.scan.outputs.output-path }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        IMAGE_REF: ${{ inputs.image }}
+        CACHE_DIR_IN: ${{ inputs.cache-dir }}
+        OUTPUT_DIR_IN: ${{ inputs.output-dir }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        TRIVY_IMAGE: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+        case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
+        cache_dir=$(realpath "$CACHE_DIR_IN")
+        mkdir -p "$OUTPUT_DIR_IN"
+        output_dir=$(realpath "$OUTPUT_DIR_IN")
+        test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
+
+        docker run --rm \
+          --name trivy-scan-image \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --mount type=bind,src="$cache_dir",dst=/cache,ro \
+          --mount type=bind,src="$output_dir",dst=/out \
+          "$TRIVY_IMAGE" \
+          image "$IMAGE_REF" \
+          --cache-dir /cache \
+          --skip-db-update \
+          --offline-scan \
+          --format sarif \
+          --exit-code 0 \
+          -o "/out/$OUTPUT_FILE"
+
+        echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"

setup-db/README.md

@@ -0,0 +1,46 @@
+# Setup DB Action
+
+A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
+
+The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
+
+**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup DB
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+```
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Trivy
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
+      - name: Setup DB
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+      - name: Scan for vulnerabilities
+        run: trivy fs .
+```
+
+## Inputs
+
+| Input            | Description                                                                 | Required | Default |
+| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
+| `cache-dir`      | Path to the Trivy cache directory                                           | No       | `${{ runner.temp }}/trivy` |
+| `trivy-version`  | Docker image reference for Trivy (digest pin recommended)                   | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
+
+**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.

setup-db/action.yaml

@@ -0,0 +1,56 @@
+name: "Setup Trivy DB"
+description: "Setup the trivy database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de"
+branding:
+  icon: "database"
+  color: "blue"
+
+inputs:
+  cache-dir:
+    description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
+    required: false
+    default: "${{ runner.temp }}/trivy"
+  trivy-version:
+    description: "Trivy docker image version to use (full image reference including digest is recommended)"
+    required: false
+    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
+
+outputs:
+  cache-dir:
+    description: "Path to the Trivy cache directory"
+    value: ${{ inputs.cache-dir }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: current-date
+      shell: bash
+      run: |
+        echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
+    - id: restore-db
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      with:
+        path: ${{ inputs.cache-dir }}
+        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        restore-keys: |
+          trivy-db-${{ steps.current-date.outputs.current-date }}
+    - if: steps.restore-db.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        docker run --rm \
+          --name trivy-db-download \
+          --user "$(id -u):$(id -g)" \
+          --read-only \
+          --env-file /dev/null \
+          --cap-drop ALL \
+          --pids-limit 64 \
+          --memory=512m \
+          --memory-swap=512m \
+          --cpus=1 \
+          --ipc private \
+          --cgroupns private \
+          --security-opt no-new-privileges \
+          --security-opt apparmor=docker-default \
+          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
+          --mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
+          ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache

setup-osv-db/README.md

@@ -1,65 +0,0 @@
-# Setup OSV offline DB Action
-
-A reusable Gitea Action that restores or populates the [OSV-Scanner local vulnerability cache](https://google.github.io/osv-scanner/usage/offline-mode/) used with `--offline-vulnerabilities`.
-
-Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.googleapis.com/` as described under [Manual database download](https://google.github.io/osv-scanner/usage/offline-mode/#manual-database-download): for each requested ecosystem, download `…/<ecosystem>/all.zip` into `osv-scanner/<ecosystem>/all.zip`. **OSV-Scanner is not invoked** for downloads.
-
-**Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths).
-
-**Note:** This action only prepares the local DB directory. Install the scanner separately.
-
-## Ecosystems input
-
-Use **`ecosystems`**: a comma-separated list (spaces around commas are trimmed). Each token is matched to an entry from [ecosystems.txt](https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt) by:
-
-- **Slug match:** lowercased, spaces → `-`, brackets removed (e.g. `GitHub Actions` and `github-actions` both match).
-- **Special case:** `docker` is not an OSV ecosystem; it is treated as **`Linux`** (useful as a default when scanning image-related data). Override with `Alpine`, `Debian`, etc. if you prefer.
-
-The **`actions/cache` key includes** the sorted, slugified list of resolved ecosystems (e.g. `github-actions,go,linux,npm`) plus the hour bucket settings, so different ecosystem sets never share a cache entry.
-
-## Usage
-
-```yaml
-uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
-with:
-  ecosystems: PyPI,npm,Go
-```
-
-## Example workflow
-
-```yaml
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup offline DB
-        id: setup-db
-        uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
-        with:
-          cache-bucket-hours: 6
-          ecosystems: github-actions,npm,go,Alpine
-      - name: Scan (offline vulnerabilities only)
-        env:
-          OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }}
-        run: osv-scanner scan source --offline-vulnerabilities -r .
-```
-
-## Inputs
-
-| Name                 | Description                                                               | Required | Default                          |
-| -------------------- | ------------------------------------------------------------------------- | -------- | -------------------------------- |
-| `cache-dir`          | Directory for `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY`                      | No       | `${{ runner.temp }}/osv-scanner` |
-| `cache-bucket-hours` | `actions/cache` primary key includes `floor(UTC unix time / (3600 × N))`. | No       | `24`                             |
-| `ecosystems`         | Comma-separated tokens (names/slugs; `docker` → `Linux`).                 | No       | `github-actions,npm,go,docker`   |
-
-## Outputs
-
-| Name        | Description        |
-| ----------- | ------------------ |
-| `cache-dir` | Same as input path |
-
-## Behavior
-
-- **Cache:** Key pattern `osv-scanner-db-{hours}h-eco-{sorted-slugs}-{bucket}`. `restore-keys` reuse the newest cache for the same hours + ecosystem set when the current time bucket misses.
-- **Populate:** On cache miss, `${cache-dir}/osv-scanner` is recreated and only the requested ecosystems are downloaded.

setup-osv-db/action.yaml

@@ -1,143 +0,0 @@
-name: "Setup OSV offline vulnerability DB"
-description: "Populate or restore the OSV-Scanner local vulnerability database cache (offline mode)"
-author: "Timo Behrendt <t.behrendt@t00n.de>"
-branding:
-  icon: "database"
-  color: "blue"
-
-inputs:
-  cache-dir:
-    description: "Directory for OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{ runner.temp }}/osv-scanner)"
-    required: false
-    default: "${{ runner.temp }}/osv-scanner"
-  cache-bucket-hours:
-    description: "actions/cache key advances every this many full hours (UTC, since epoch). Example: 24 ≈ daily bucket; 1 = new key each hour."
-    required: false
-    default: "24"
-  ecosystems:
-    description: "Comma-separated ecosystem tokens (slug or official name, see README). OSV has no Docker Hub bucket; token `docker` installs the `Linux` ecosystem as a practical default for image-style data."
-    required: false
-    default: "github-actions,npm,go,docker"
-
-outputs:
-  cache-dir:
-    description: "Path passed to OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY"
-    value: ${{ inputs.cache-dir }}
-
-runs:
-  using: "composite"
-  steps:
-    - id: prepare
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        slugify() {
-          local s="$1"
-          s=$(printf '%s' "$s" | tr '[:upper:]' '[:lower:]')
-          s=$(printf '%s' "$s" | sed 's/\[//g;s/\]//g')
-          s=$(printf '%s' "$s" | sed 's/[[:space:]]\+/-/g')
-          printf '%s' "$s"
-        }
-
-        HOURS="${{ inputs.cache-bucket-hours }}"
-        case "$HOURS" in
-          ''|*[!0-9]*) echo "cache-bucket-hours must be a positive integer, got: $HOURS" >&2; exit 1 ;;
-        esac
-        if [ "$HOURS" -lt 1 ]; then
-          echo "cache-bucket-hours must be >= 1" >&2
-          exit 1
-        fi
-        bucket=$(( $(date -u +%s) / (3600 * HOURS) ))
-        echo "hours=$HOURS" >> "$GITHUB_OUTPUT"
-        echo "bucket=$bucket" >> "$GITHUB_OUTPUT"
-
-        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
-        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
-        : > "$RESOLVED_FILE"
-
-        ecosystems_all="$(mktemp)"
-        curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt" -o "$ecosystems_all"
-
-        declare -A SLUG_TO_OFFICIAL=()
-        while IFS= read -r line || [ -n "$line" ]; do
-          line="${line//$'\r'/}"
-          [ -z "$line" ] && continue
-          slug=$(slugify "$line")
-          SLUG_TO_OFFICIAL["$slug"]="$line"
-        done < "$ecosystems_all"
-        rm -f "$ecosystems_all"
-
-        declare -A SEEN_CANONICAL=()
-        INPUT="${{ inputs.ecosystems }}"
-        INPUT="${INPUT//$'\r'/}"
-        if [ -z "${INPUT//[[:space:]]/}" ]; then
-          echo "ecosystems input is empty" >&2
-          exit 1
-        fi
-
-        IFS=',' read -ra PARTS <<< "$INPUT"
-        for raw in "${PARTS[@]}"; do
-          token=$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-          [ -z "$token" ] && continue
-          tslug=$(slugify "$token")
-          if [ "$tslug" = "docker" ]; then
-            official="Linux"
-          elif [ -n "${SLUG_TO_OFFICIAL[$tslug]+x}" ]; then
-            official="${SLUG_TO_OFFICIAL[$tslug]}"
-          else
-            echo "Unknown ecosystem token: ${token}. Valid names/slugs match https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt (token docker -> Linux)." >&2
-            exit 1
-          fi
-          if [ -z "${SEEN_CANONICAL[$official]+x}" ]; then
-            SEEN_CANONICAL[$official]=1
-            printf '%s\n' "$official" >> "$RESOLVED_FILE"
-          fi
-        done
-
-        if [ ! -s "$RESOLVED_FILE" ]; then
-          echo "No ecosystems resolved from input" >&2
-          exit 1
-        fi
-
-        slug_keys=()
-        while IFS= read -r official || [ -n "$official" ]; do
-          [ -z "$official" ] && continue
-          slug_keys+=("$(slugify "$official")")
-        done < "$RESOLVED_FILE"
-        ecosystems_key=$(printf '%s\n' "${slug_keys[@]}" | sort -u | paste -sd, -)
-        echo "ecosystems-key=$ecosystems_key" >> "$GITHUB_OUTPUT"
-    - id: restore-db
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
-      with:
-        path: ${{ inputs.cache-dir }}
-        key: osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-${{ steps.prepare.outputs.bucket }}
-        restore-keys: |
-          osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-
-    - if: steps.restore-db.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        set -euo pipefail
-        CACHE_DIR="${{ inputs.cache-dir }}"
-        ROOT="${CACHE_DIR}/osv-scanner"
-        BASE="https://osv-vulnerabilities.storage.googleapis.com"
-        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
-        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
-
-        rm -rf "$ROOT"
-        mkdir -p "$ROOT"
-
-        if [ ! -s "$RESOLVED_FILE" ]; then
-          echo "Missing resolved ecosystem list at $RESOLVED_FILE" >&2
-          exit 1
-        fi
-
-        while IFS= read -r ecosystem || [ -n "$ecosystem" ]; do
-          [ -z "$ecosystem" ] && continue
-          enc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$ecosystem")"
-          dest_dir="${ROOT}/${ecosystem}"
-          mkdir -p "$dest_dir"
-          tmp="$(mktemp)"
-          curl -fsSL "${BASE}/${enc}/all.zip" -o "$tmp"
-          mv "$tmp" "${dest_dir}/all.zip"
-        done < "$RESOLVED_FILE"