.gitea/workflows/cd.yaml

@@ -0,0 +1,24 @@
+name: CD
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Increment tag
+        id: increment-tag
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.0.10
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+      - name: Push tag
+        run: |
+          git tag ${{ steps.increment-tag.outputs.new-tag }}
+          git push origin ${{ steps.increment-tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -0,0 +1,20 @@
+name: CI
+
+on:
+  pull_request:
+
+jobs:
+  dry-run-setup-trivy:
+    name: Dry-Run Setup Trivy
+    runs-on:
+      - ubuntu-latest
+      - linux-amd64
+    steps:
+      - uses: actions/checkout@v5
+      - name: Setup Trivy
+        uses: ./setup-trivy
+        with:
+          version: latest
+          architecture: amd64
+      - name: Run Trivy
+        run: trivy --version

setup-trivy/README.md

@@ -0,0 +1,76 @@
+# Setup Trivy Action
+
+A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerability scanning.
+
+## Features
+
+- 🚀 Easy setup with minimal configuration
+- 🔧 Configurable Trivy version and architecture
+- ✅ Input validation and error handling
+- 🔄 Compatible with Gitea Actions and GitHub Actions
+- ⚡ **Smart caching** - Uses native GitHub Actions cache with proper cache-hit detection
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup Trivy
+  uses: your-username/trivy-actions@main/setup-trivy
+```
+
+### Advanced Usage
+
+```yaml
+- name: Setup Trivy
+  uses: your-username/trivy-actions@main/setup-trivy
+  with:
+    version: "v0.57.1" # Optional: Trivy version (default: v0.57.1)
+    architecture: "amd64" # Optional: amd64 or arm64 (default: amd64)
+```
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux-amd64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Trivy
+        uses: your-username/trivy-actions@main/setup-trivy
+        with:
+          version: "v0.57.1"
+          architecture: "amd64"
+
+      - name: Run Trivy vulnerability scanner
+        run: trivy fs .
+```
+
+## Action Steps
+
+The action is structured into logical steps for better maintainability:
+
+1. **Cache Trivy binary** - Uses `actions/cache@v4` to restore cached binary
+2. **Validate inputs** - Validates version and architecture parameters
+3. **Download and install Trivy** - Only runs on cache miss, downloads and installs binary
+4. **Add Trivy to PATH** - Ensures Trivy is available in subsequent steps
+5. **Verify Trivy installation** - Confirms installation and shows version
+
+## Inputs
+
+| Input          | Description                               | Required | Default   |
+| -------------- | ----------------------------------------- | -------- | --------- |
+| `version`      | Trivy version to download (e.g., v0.57.1) | No       | `v0.57.1` |
+| `architecture` | System architecture (amd64, arm64)        | No       | `amd64`   |
+
+## Supported Platforms
+
+- **Linux**: amd64, arm64

setup-trivy/action.yml

@@ -0,0 +1,83 @@
+name: "Setup Trivy"
+description: "Download and setup Trivy binary for vulnerability scanning"
+author: "Gitea Actions"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "Trivy version to download (e.g., v0.57.1)"
+    required: false
+    default: "v0.57.1"
+  architecture:
+    description: "System architecture (amd64, arm64)"
+    required: false
+    default: "amd64"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Cache Trivy binary
+      id: cache-trivy
+      uses: actions/cache@v4
+      with:
+        path: /usr/local/bin/trivy
+        key: trivy-${{ inputs.version }}-${{ inputs.architecture }}-${{ hashFiles('**/action.yml') }}
+        restore-keys: |
+          trivy-${{ inputs.version }}-${{ inputs.architecture }}-
+          trivy-${{ inputs.version }}-
+
+    - name: Validate inputs
+      shell: bash
+      run: |
+        set -e
+
+        VERSION="${{ inputs.version }}"
+        ARCH="${{ inputs.architecture }}"
+
+        # Validate architecture
+        case "$ARCH" in
+          amd64|arm64)
+            ;;
+          *)
+            echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64"
+            exit 1
+            ;;
+        esac
+
+    - name: Download and install Trivy
+      if: steps.cache-trivy.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -e
+
+        VERSION="${{ inputs.version }}"
+        ARCH="${{ inputs.architecture }}"
+
+        case "$ARCH" in
+          amd64)
+            ARCH="64bit"
+            ;;
+          arm64)
+            ARCH="ARM64"
+            ;;
+        esac
+
+        mkdir -p /usr/local/bin
+
+        curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${ARCH}.tar.gz" -o trivy.tar.gz
+        tar -xzf trivy.tar.gz
+        chmod +x trivy
+        mv trivy /usr/local/bin/
+        rm trivy.tar.gz
+
+    - name: Add Trivy to PATH
+      shell: bash
+      run: |
+        echo "/usr/local/bin" >> $GITHUB_PATH
+
+    - name: Verify Trivy installation
+      shell: bash
+      run: |
+        trivy version