.gitea/workflows/ci.yaml

@@ -18,3 +18,23 @@ jobs:
           architecture: amd64
       - name: Run Trivy
         run: trivy --version
+
+  test-setup-db:
+    name: Test Setup DB
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./setup-trivy
+        with:
+          version: v0.66.0
+          architecture: amd64
+      - name: Setup DB
+        uses: ./setup-db
+        with:
+          cache-dir: ${{ runner.temp }}/trivy
+      - name: Run Trivy
+        env:
+          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
+        run: trivy fs --skip-db-update .

setup-db/README.md

@@ -0,0 +1,44 @@
+# Setup DB Action
+
+A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
+
+**Note:** This action only sets up the database. Trivy itself must be installed separately (e.g., using the `setup-trivy` action).
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Setup DB
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+```
+
+### Complete Example
+
+```yaml
+name: Security Scan
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on:
+      - ubuntu-latest
+      - linux_amd64
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Trivy
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
+        with:
+          version: "v0.66.0"
+          architecture: "amd64"
+      - name: Setup DB
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
+      - name: Scan for vulnerabilities
+        run: trivy fs .
+```
+
+## Inputs
+
+| Input       | Description                       | Required | Default          |
+| ----------- | --------------------------------- | -------- | ---------------- |
+| `cache-dir` | Path to the Trivy cache directory | No       | `~/.cache/trivy` |

setup-db/action.yaml

@@ -0,0 +1,31 @@
+name: "Setup Trivy DB"
+description: "Setup the trivy database, restoring from cache if available"
+author: "Timo Behrendt <t.behrendt@t00n.de"
+branding:
+  icon: "database"
+  color: "blue"
+
+inputs:
+  cache-dir:
+    description: "Path to the Trivy cache directory (default: ~/.cache/trivy)"
+    required: false
+    default: "~/.cache/trivy"
+
+runs:
+  using: "composite"
+  steps:
+    - id: current-date
+      shell: bash
+      run: |
+        echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
+    - id: restore-db
+      uses: actions/cache@v4
+      with:
+        path: ${{ inputs.cache-dir }}
+        key: trivy-db-${{ steps.current-date.outputs.current-date }}
+        restore-keys: |
+          trivy-db-${{ steps.current-date.outputs.current-date }}
+          trivy-db-
+    - if: steps.restore-db.outputs.cache-hit != 'true'
+      shell: bash
+      run: trivy fs --download-db-only --cache-dir "${{ inputs.cache-dir }}"