From 32041e0a21d9e7113f3746d3756ec5d4981cec70 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Sat, 8 Nov 2025 18:42:14 +0100 Subject: [PATCH 1/4] feat(setup-trivy)!: automatically determine arch --- setup-trivy/README.md | 9 +++------ setup-trivy/action.yaml | 36 ++++++++---------------------------- 2 files changed, 11 insertions(+), 34 deletions(-) diff --git a/setup-trivy/README.md b/setup-trivy/README.md index ef04950..6835c39 100644 --- a/setup-trivy/README.md +++ b/setup-trivy/README.md @@ -11,7 +11,6 @@ A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerab uses: your-username/trivy-actions@main/setup-trivy with: version: "v0.66.0" # Optional: Trivy version (default: v0.66.0) - architecture: "amd64" # Optional: amd64 or arm64 (default: amd64) ``` ### Complete Example @@ -31,14 +30,12 @@ jobs: uses: your-username/trivy-actions@main/setup-trivy with: version: "v0.66.0" - architecture: "amd64" - name: Scan for vulnerabilities run: trivy fs . ``` ## Inputs -| Input | Description | Required | Default | -| -------------- | ----------------------------------------- | -------- | --------- | -| `version` | Trivy version to download (e.g., v0.66.0) | No | `v0.66.0` | -| `architecture` | System architecture (amd64, arm64) | No | `amd64` | +| Input | Description | Required | Default | +| --------- | ----------------------------------------- | -------- | --------- | +| `version` | Trivy version to download (e.g., v0.66.0) | No | `v0.66.0` | diff --git a/setup-trivy/action.yaml b/setup-trivy/action.yaml index a9f18af..c266cc1 100644 --- a/setup-trivy/action.yaml +++ b/setup-trivy/action.yaml @@ -7,13 +7,9 @@ branding: inputs: version: - description: "Trivy version to download (e.g., v0.66.0)" + description: "Trivy version to download (e.g., latest)" required: false default: "v0.66.0" - architecture: - description: "System architecture (amd64, arm64)" - required: false - default: "amd64" runs: using: "composite" @@ -28,24 +24,18 @@ runs: trivy-${{ inputs.version }}-${{ inputs.architecture }}- trivy-${{ inputs.version }}- - - name: Validate inputs - shell: bash + - shell: bash run: | set -e - - VERSION="${{ inputs.version }}" - ARCH="${{ inputs.architecture }}" - - # Validate architecture - case "$ARCH" in - amd64|arm64) + case "$(uname -m)" in + x86_64) + ARCH="64bit" ;; - *) - echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64" - exit 1 + aarch64) + ARCH="ARM64" ;; esac - + echo "ARCH=$ARCH" >> $GITHUB_OUTPUT - name: Download and install Trivy if: steps.cache-trivy.outputs.cache-hit != 'true' shell: bash @@ -53,16 +43,6 @@ runs: set -e VERSION="${{ inputs.version }}" - ARCH="${{ inputs.architecture }}" - - case "$ARCH" in - amd64) - ARCH="64bit" - ;; - arm64) - ARCH="ARM64" - ;; - esac mkdir -p /usr/local/bin -- 2.52.0 From d33efe2071a2d63298e2a7bb3f06fcae13cfa743 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Sat, 8 Nov 2025 18:44:48 +0100 Subject: [PATCH 2/4] test: run setup-trviy on both amd64 and arm64 --- .gitea/workflows/ci.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index e37790c..aae5763 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -5,17 +5,19 @@ on: jobs: test-setup-trivy: - name: Test Setup Trivy + strategy: + matrix: + arch: [amd64, arm64] + name: Test Setup Trivy ${{ matrix.arch }} runs-on: - ubuntu-latest - - linux_amd64 + - linux_${{ matrix.arch }} steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - name: Setup Trivy uses: ./setup-trivy with: version: v0.66.0 - architecture: amd64 - name: Run Trivy run: trivy --version @@ -23,13 +25,11 @@ jobs: name: Test Setup DB runs-on: - ubuntu-latest - - linux_amd64 steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - uses: ./setup-trivy with: version: v0.66.0 - architecture: amd64 - name: Setup DB uses: ./setup-db with: -- 2.52.0 From f26a0c4a9a279ee493a96318b91f09b58d0f8e6d Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Sat, 8 Nov 2025 18:49:50 +0100 Subject: [PATCH 3/4] fix: determine arch before trying to restore from cache --- setup-trivy/action.yaml | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/setup-trivy/action.yaml b/setup-trivy/action.yaml index c266cc1..745583f 100644 --- a/setup-trivy/action.yaml +++ b/setup-trivy/action.yaml @@ -14,17 +14,8 @@ inputs: runs: using: "composite" steps: - - name: Cache Trivy binary - id: cache-trivy - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 - with: - path: /usr/local/bin/trivy - key: trivy-${{ inputs.version }}-${{ inputs.architecture }} - restore-keys: | - trivy-${{ inputs.version }}-${{ inputs.architecture }}- - trivy-${{ inputs.version }}- - - shell: bash + id: arch run: | set -e case "$(uname -m)" in @@ -36,6 +27,14 @@ runs: ;; esac echo "ARCH=$ARCH" >> $GITHUB_OUTPUT + - name: Cache Trivy binary + id: cache-trivy + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + with: + path: /usr/local/bin/trivy + key: trivy-${{ inputs.version }}-${{ steps.arch.outputs.arch }} + restore-keys: | + trivy-${{ inputs.version }}-${{ steps.arch.outputs.arch }} - name: Download and install Trivy if: steps.cache-trivy.outputs.cache-hit != 'true' shell: bash @@ -46,7 +45,7 @@ runs: mkdir -p /usr/local/bin - curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${ARCH}.tar.gz" -o trivy.tar.gz + curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${{ steps.arch.outputs.arch }}.tar.gz" -o trivy.tar.gz tar -xzf trivy.tar.gz chmod +x trivy mv trivy /usr/local/bin/ -- 2.52.0 From 328e630b07f021aa94e2532405968dabb4339f37 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Sat, 8 Nov 2025 19:17:09 +0100 Subject: [PATCH 4/4] fix docs --- setup-db/README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/setup-db/README.md b/setup-db/README.md index 0f658f3..b765a7a 100644 --- a/setup-db/README.md +++ b/setup-db/README.md @@ -30,7 +30,6 @@ jobs: uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1 with: version: "v0.66.0" - architecture: "amd64" - name: Setup DB uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1 - name: Scan for vulnerabilities -- 2.52.0