diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index a3a4d0a..e990adb 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -16,8 +16,6 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - name: Setup Trivy uses: ./setup-trivy - with: - version: v0.66.0 - name: Run Trivy run: trivy --version @@ -28,8 +26,6 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - uses: ./setup-trivy - with: - version: v0.66.0 - name: Setup DB id: setup-db uses: ./setup-db diff --git a/setup-db/README.md b/setup-db/README.md index b765a7a..4f59fa2 100644 --- a/setup-db/README.md +++ b/setup-db/README.md @@ -28,8 +28,6 @@ jobs: - uses: actions/checkout@v4 - name: Setup Trivy uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1 - with: - version: "v0.66.0" - name: Setup DB uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1 - name: Scan for vulnerabilities diff --git a/setup-trivy/README.md b/setup-trivy/README.md index 6835c39..78e877f 100644 --- a/setup-trivy/README.md +++ b/setup-trivy/README.md @@ -10,7 +10,7 @@ A reusable Gitea Action that downloads and sets up the Trivy binary for vulnerab - name: Setup Trivy uses: your-username/trivy-actions@main/setup-trivy with: - version: "v0.66.0" # Optional: Trivy version (default: v0.66.0) + version: "v0.66.0" # Optional: Trivy version (default: latest) ``` ### Complete Example @@ -28,14 +28,12 @@ jobs: - uses: actions/checkout@v4 - name: Setup Trivy uses: your-username/trivy-actions@main/setup-trivy - with: - version: "v0.66.0" - name: Scan for vulnerabilities run: trivy fs . ``` ## Inputs -| Input | Description | Required | Default | -| --------- | ----------------------------------------- | -------- | --------- | -| `version` | Trivy version to download (e.g., v0.66.0) | No | `v0.66.0` | +| Input | Description | Required | Default | +| --------- | ----------------------------------------- | -------- | -------- | +| `version` | Trivy version to download (e.g., v0.66.0) | No | `latest` | diff --git a/setup-trivy/action.yaml b/setup-trivy/action.yaml index 745583f..702e2d8 100644 --- a/setup-trivy/action.yaml +++ b/setup-trivy/action.yaml @@ -9,7 +9,7 @@ inputs: version: description: "Trivy version to download (e.g., latest)" required: false - default: "v0.66.0" + default: "latest" runs: using: "composite" @@ -27,21 +27,32 @@ runs: ;; esac echo "ARCH=$ARCH" >> $GITHUB_OUTPUT + - name: Resolve version + shell: bash + id: version + run: | + set -e + if [ "${{ inputs.version }}" = "latest" ]; then + VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name') + else + VERSION="${{ inputs.version }}" + fi + echo "VERSION=$VERSION" >> $GITHUB_OUTPUT - name: Cache Trivy binary id: cache-trivy uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: /usr/local/bin/trivy - key: trivy-${{ inputs.version }}-${{ steps.arch.outputs.arch }} + key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }} restore-keys: | - trivy-${{ inputs.version }}-${{ steps.arch.outputs.arch }} + trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }} - name: Download and install Trivy if: steps.cache-trivy.outputs.cache-hit != 'true' shell: bash run: | set -e - VERSION="${{ inputs.version }}" + VERSION="${{ steps.version.outputs.version }}" mkdir -p /usr/local/bin