From 872c37437bb5ab6702b5b79b8a47f2d37be8dd55 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Wed, 24 Sep 2025 20:45:28 +0200 Subject: [PATCH 1/8] initial draft --- .gitea/workflows/cd.yaml | 24 ++++++++++++ .gitea/workflows/ci.yaml | 20 ++++++++++ setup-trivy/README.md | 76 ++++++++++++++++++++++++++++++++++++ setup-trivy/action.yml | 83 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 203 insertions(+) create mode 100644 .gitea/workflows/cd.yaml create mode 100644 .gitea/workflows/ci.yaml create mode 100644 setup-trivy/README.md create mode 100644 setup-trivy/action.yml diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml new file mode 100644 index 0000000..6bd7c1c --- /dev/null +++ b/.gitea/workflows/cd.yaml @@ -0,0 +1,24 @@ +name: CD + +on: + push: + branches: + - main + +jobs: + release: + name: Release + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + with: + fetch-depth: 0 + - name: Increment tag + id: increment-tag + uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.0.10 + with: + token: ${{ secrets.GITEA_TOKEN }} + - name: Push tag + run: | + git tag ${{ steps.increment-tag.outputs.new-tag }} + git push origin ${{ steps.increment-tag.outputs.new-tag }} diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml new file mode 100644 index 0000000..abf09e0 --- /dev/null +++ b/.gitea/workflows/ci.yaml @@ -0,0 +1,20 @@ +name: CI + +on: + pull_request: + +jobs: + dry-run-setup-trivy: + name: Dry-Run Setup Trivy + runs-on: + - ubuntu-latest + - linux-amd64 + steps: + - uses: actions/checkout@v5 + - name: Setup Trivy + uses: ./setup-trivy + with: + version: latest + architecture: amd64 + - name: Run Trivy + run: trivy --version diff --git a/setup-trivy/README.md b/setup-trivy/README.md new file mode 100644 index 0000000..b03e083 --- /dev/null +++ b/setup-trivy/README.md @@ -0,0 +1,76 @@ +# Setup Trivy Action + +A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning. + +## Features + +- 🚀 Easy setup with minimal configuration +- 🔧 Configurable Trivy version and architecture +- ✅ Input validation and error handling +- 🔄 Compatible with Gitea Actions and GitHub Actions +- ⚡ **Smart caching** - Uses native GitHub Actions cache with proper cache-hit detection + +## Usage + +### Basic Usage + +```yaml +- name: Setup Trivy + uses: your-username/trivy-actions@main/setup-trivy +``` + +### Advanced Usage + +```yaml +- name: Setup Trivy + uses: your-username/trivy-actions@main/setup-trivy + with: + version: "v0.57.1" # Optional: Trivy version (default: v0.57.1) + architecture: "amd64" # Optional: amd64 or arm64 (default: amd64) +``` + +### Complete Example + +```yaml +name: Security Scan +on: [push, pull_request] + +jobs: + security: + runs-on: + - ubuntu-latest + - linux-amd64 + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Trivy + uses: your-username/trivy-actions@main/setup-trivy + with: + version: "v0.57.1" + architecture: "amd64" + + - name: Run Trivy vulnerability scanner + run: trivy fs . +``` + +## Action Steps + +The action is structured into logical steps for better maintainability: + +1. **Cache Trivy binary** - Uses `actions/cache@v4` to restore cached binary +2. **Validate inputs** - Validates version and architecture parameters +3. **Download and install Trivy** - Only runs on cache miss, downloads and installs binary +4. **Add Trivy to PATH** - Ensures Trivy is available in subsequent steps +5. **Verify Trivy installation** - Confirms installation and shows version + +## Inputs + +| Input | Description | Required | Default | +| -------------- | ----------------------------------------- | -------- | --------- | +| `version` | Trivy version to download (e.g., v0.57.1) | No | `v0.57.1` | +| `architecture` | System architecture (amd64, arm64) | No | `amd64` | + +## Supported Platforms + +- **Linux**: amd64, arm64 diff --git a/setup-trivy/action.yml b/setup-trivy/action.yml new file mode 100644 index 0000000..1a573aa --- /dev/null +++ b/setup-trivy/action.yml @@ -0,0 +1,83 @@ +name: "Setup Trivy" +description: "Download and setup Trivy binary for vulnerability scanning" +author: "Gitea Actions" +branding: + icon: "shield" + color: "blue" + +inputs: + version: + description: "Trivy version to download (e.g., v0.57.1)" + required: false + default: "v0.57.1" + architecture: + description: "System architecture (amd64, arm64)" + required: false + default: "amd64" + +runs: + using: "composite" + steps: + - name: Cache Trivy binary + id: cache-trivy + uses: actions/cache@v4 + with: + path: /usr/local/bin/trivy + key: trivy-${{ inputs.version }}-${{ inputs.architecture }}-${{ hashFiles('**/action.yml') }} + restore-keys: | + trivy-${{ inputs.version }}-${{ inputs.architecture }}- + trivy-${{ inputs.version }}- + + - name: Validate inputs + shell: bash + run: | + set -e + + VERSION="${{ inputs.version }}" + ARCH="${{ inputs.architecture }}" + + # Validate architecture + case "$ARCH" in + amd64|arm64) + ;; + *) + echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64" + exit 1 + ;; + esac + + - name: Download and install Trivy + if: steps.cache-trivy.outputs.cache-hit != 'true' + shell: bash + run: | + set -e + + VERSION="${{ inputs.version }}" + ARCH="${{ inputs.architecture }}" + + case "$ARCH" in + amd64) + ARCH="64bit" + ;; + arm64) + ARCH="ARM64" + ;; + esac + + mkdir -p /usr/local/bin + + curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${ARCH}.tar.gz" -o trivy.tar.gz + tar -xzf trivy.tar.gz + chmod +x trivy + mv trivy /usr/local/bin/ + rm trivy.tar.gz + + - name: Add Trivy to PATH + shell: bash + run: | + echo "/usr/local/bin" >> $GITHUB_PATH + + - name: Verify Trivy installation + shell: bash + run: | + trivy version -- 2.52.0 From d2e6f75b4ca8453d5dfc8511a901c3d235c55671 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Wed, 24 Sep 2025 20:46:28 +0200 Subject: [PATCH 2/8] fix runner name --- .gitea/workflows/ci.yaml | 2 +- setup-trivy/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index abf09e0..42554e1 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -8,7 +8,7 @@ jobs: name: Dry-Run Setup Trivy runs-on: - ubuntu-latest - - linux-amd64 + - linux_amd64 steps: - uses: actions/checkout@v5 - name: Setup Trivy diff --git a/setup-trivy/README.md b/setup-trivy/README.md index b03e083..9ac46e9 100644 --- a/setup-trivy/README.md +++ b/setup-trivy/README.md @@ -39,7 +39,7 @@ jobs: security: runs-on: - ubuntu-latest - - linux-amd64 + - linux_amd64 steps: - name: Checkout code uses: actions/checkout@v4 -- 2.52.0 From 6ab977fdc29edf426668169ee87a7320fb9f5011 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Wed, 24 Sep 2025 21:07:52 +0200 Subject: [PATCH 3/8] fix trivy version in test --- .gitea/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 42554e1..599b359 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -14,7 +14,7 @@ jobs: - name: Setup Trivy uses: ./setup-trivy with: - version: latest + version: v0.66.0 architecture: amd64 - name: Run Trivy run: trivy --version -- 2.52.0 From d25757b3372127d5da44a3885ab4acf6303c2a07 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Wed, 24 Sep 2025 21:09:50 +0200 Subject: [PATCH 4/8] remove action hash from trivy cache --- setup-trivy/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup-trivy/action.yml b/setup-trivy/action.yml index 1a573aa..82e9fbb 100644 --- a/setup-trivy/action.yml +++ b/setup-trivy/action.yml @@ -23,7 +23,7 @@ runs: uses: actions/cache@v4 with: path: /usr/local/bin/trivy - key: trivy-${{ inputs.version }}-${{ inputs.architecture }}-${{ hashFiles('**/action.yml') }} + key: trivy-${{ inputs.version }}-${{ inputs.architecture }} restore-keys: | trivy-${{ inputs.version }}-${{ inputs.architecture }}- trivy-${{ inputs.version }}- -- 2.52.0 From ee3554086428ea1dae655a71d568119288e2e3d5 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Thu, 25 Sep 2025 19:18:36 +0200 Subject: [PATCH 5/8] rename yaml --- setup-trivy/{action.yml => action.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename setup-trivy/{action.yml => action.yaml} (100%) diff --git a/setup-trivy/action.yml b/setup-trivy/action.yaml similarity index 100% rename from setup-trivy/action.yml rename to setup-trivy/action.yaml -- 2.52.0 From 0706f62920d5d6ea5ceff7b22fc9724937bbc749 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Thu, 25 Sep 2025 19:19:49 +0200 Subject: [PATCH 6/8] Update Trivy version to v0.66.0 for consistency --- setup-trivy/README.md | 6 +++--- setup-trivy/action.yaml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/setup-trivy/README.md b/setup-trivy/README.md index 9ac46e9..a413c51 100644 --- a/setup-trivy/README.md +++ b/setup-trivy/README.md @@ -25,7 +25,7 @@ A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerab - name: Setup Trivy uses: your-username/trivy-actions@main/setup-trivy with: - version: "v0.57.1" # Optional: Trivy version (default: v0.57.1) + version: "v0.66.0" # Optional: Trivy version (default: v0.66.0) architecture: "amd64" # Optional: amd64 or arm64 (default: amd64) ``` @@ -47,7 +47,7 @@ jobs: - name: Setup Trivy uses: your-username/trivy-actions@main/setup-trivy with: - version: "v0.57.1" + version: "v0.66.0" architecture: "amd64" - name: Run Trivy vulnerability scanner @@ -68,7 +68,7 @@ The action is structured into logical steps for better maintainability: | Input | Description | Required | Default | | -------------- | ----------------------------------------- | -------- | --------- | -| `version` | Trivy version to download (e.g., v0.57.1) | No | `v0.57.1` | +| `version` | Trivy version to download (e.g., v0.66.0) | No | `v0.66.0` | | `architecture` | System architecture (amd64, arm64) | No | `amd64` | ## Supported Platforms diff --git a/setup-trivy/action.yaml b/setup-trivy/action.yaml index 82e9fbb..930d561 100644 --- a/setup-trivy/action.yaml +++ b/setup-trivy/action.yaml @@ -7,9 +7,9 @@ branding: inputs: version: - description: "Trivy version to download (e.g., v0.57.1)" + description: "Trivy version to download (e.g., v0.66.0)" required: false - default: "v0.57.1" + default: "v0.66.0" architecture: description: "System architecture (amd64, arm64)" required: false -- 2.52.0 From 524beba84f23d88208ed2796b77a1523b2836277 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Thu, 25 Sep 2025 19:23:06 +0200 Subject: [PATCH 7/8] slim down docs --- setup-trivy/README.md | 36 ++---------------------------------- 1 file changed, 2 insertions(+), 34 deletions(-) diff --git a/setup-trivy/README.md b/setup-trivy/README.md index a413c51..ef04950 100644 --- a/setup-trivy/README.md +++ b/setup-trivy/README.md @@ -2,25 +2,10 @@ A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning. -## Features - -- 🚀 Easy setup with minimal configuration -- 🔧 Configurable Trivy version and architecture -- ✅ Input validation and error handling -- 🔄 Compatible with Gitea Actions and GitHub Actions -- ⚡ **Smart caching** - Uses native GitHub Actions cache with proper cache-hit detection - ## Usage ### Basic Usage -```yaml -- name: Setup Trivy - uses: your-username/trivy-actions@main/setup-trivy -``` - -### Advanced Usage - ```yaml - name: Setup Trivy uses: your-username/trivy-actions@main/setup-trivy @@ -41,36 +26,19 @@ jobs: - ubuntu-latest - linux_amd64 steps: - - name: Checkout code - uses: actions/checkout@v4 - + - uses: actions/checkout@v4 - name: Setup Trivy uses: your-username/trivy-actions@main/setup-trivy with: version: "v0.66.0" architecture: "amd64" - - - name: Run Trivy vulnerability scanner + - name: Scan for vulnerabilities run: trivy fs . ``` -## Action Steps - -The action is structured into logical steps for better maintainability: - -1. **Cache Trivy binary** - Uses `actions/cache@v4` to restore cached binary -2. **Validate inputs** - Validates version and architecture parameters -3. **Download and install Trivy** - Only runs on cache miss, downloads and installs binary -4. **Add Trivy to PATH** - Ensures Trivy is available in subsequent steps -5. **Verify Trivy installation** - Confirms installation and shows version - ## Inputs | Input | Description | Required | Default | | -------------- | ----------------------------------------- | -------- | --------- | | `version` | Trivy version to download (e.g., v0.66.0) | No | `v0.66.0` | | `architecture` | System architecture (amd64, arm64) | No | `amd64` | - -## Supported Platforms - -- **Linux**: amd64, arm64 -- 2.52.0 From 4c22a24c534ba47660ca88549fb816e350db4bc8 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Thu, 25 Sep 2025 19:23:46 +0200 Subject: [PATCH 8/8] rename test --- .gitea/workflows/ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 599b359..11d4cd1 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -4,8 +4,8 @@ on: pull_request: jobs: - dry-run-setup-trivy: - name: Dry-Run Setup Trivy + test-setup-trivy: + name: Test Setup Trivy runs-on: - ubuntu-latest - linux_amd64 -- 2.52.0