name: "Setup Trivy"
description: "Download and setup Trivy binary for vulnerability scanning"
author: "Gitea Actions"
branding:
  icon: "shield"
  color: "blue"

inputs:
  version:
    description: "Trivy version to download (e.g., latest)"
    required: false
    default: "latest"

runs:
  using: "composite"
  steps:
    - shell: bash
      id: arch
      run: |
        set -e
        case "$(uname -m)" in
          x86_64)
            ARCH="64bit"
            ;;
          aarch64)
            ARCH="ARM64"
            ;;
        esac
        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
    - name: Resolve version
      shell: bash
      id: version
      run: |
        set -e
        if [ "${{ inputs.version }}" = "latest" ]; then
          VERSION=$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r '.tag_name')
        else
          VERSION="${{ inputs.version }}"
        fi
        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
    - name: Cache Trivy binary
      id: cache-trivy
      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
      with:
        path: /usr/local/bin/trivy
        key: trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
        restore-keys: |
          trivy-${{ steps.version.outputs.version }}-${{ steps.arch.outputs.arch }}
    - name: Download and install Trivy
      if: steps.cache-trivy.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -e

        VERSION="${{ steps.version.outputs.version }}"

        mkdir -p /usr/local/bin

        curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${{ steps.arch.outputs.arch }}.tar.gz" -o trivy.tar.gz
        tar -xzf trivy.tar.gz
        chmod +x trivy
        mv trivy /usr/local/bin/
        rm trivy.tar.gz

    - name: Add Trivy to PATH
      shell: bash
      run: |
        echo "/usr/local/bin" >> $GITHUB_PATH